Update Helm chart and changelog with 4.143.1 (#8072)

* Remove Node patch
* Update patches
Just one conflict, they use user-data-dir now which is something we
already have been doing for a long time.

.github/dependabot.yaml

@@ -9,8 +9,6 @@ updates:
     cooldown:
       default-days: 7
     labels: []
-    commit-message:
-      prefix: "chore"
 
   - package-ecosystem: "npm"
     directory: "/"

.github/semantic.yaml

@@ -1,66 +0,0 @@
-###############################################################################
-# This file configures "Semantic Pull Requests", which is documented here:
-# https://github.com/zeke/semantic-pull-requests
-###############################################################################
-
-# Scopes are optionally supplied after a 'type'. For example, in
-#
-# feat(docs): autostart ui
-#
-# '(docs)' is the scope. Scopes are used to signify where the change occurred.
-scopes:
-  # docs: changes to the code-server documentation.
-  - docs
-
-  # vendor: changes to vendored dependencies.
-  - vendor
-
-  # deps: changes to code-server's dependencies.
-  - deps
-
-  # cs: changes to code specific to code-server.
-  - cs
-
-  # cli: changes to the command-line interface.
-  - cli
-
-# We only check that the PR title is semantic. The PR title is automatically
-# applied to the "Squash & Merge" flow as the suggested commit message, so this
-# should suffice unless someone drastically alters the message in that flow.
-titleOnly: true
-
-# Types are the 'tag' types in a commit or PR title. For example, in
-#
-# chore: fix thing
-#
-# 'chore' is the type.
-types:
-  # A build of any kind.
-  - build
-
-  # A user-facing change that corrects a defect in code-server.
-  - fix
-
-  # Any code task that is ignored for changelog purposes. Examples include
-  # devbin scripts and internal-only configurations.
-  - chore
-
-  # Any work performed on CI.
-  - ci
-
-  # Work that directly implements or supports the implementation of a feature.
-  - feat
-
-  # A refactor changes code structure without any behavioral change.
-  - refactor
-
-  # A git revert for any style of commit.
-  - revert
-
-  # Adding tests of any kind. Should be separate from feature or fix
-  # implementations. For example, if a commit adds a fix + test, it's a fix
-  # commit. If a commit is simply bumping coverage, it's a test commit.
-  - test
-
-  # A new release.
-  - release

.github/workflows/build.yaml

@@ -27,7 +27,7 @@ jobs:
       helm: ${{ steps.filter.outputs.helm }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |
@@ -101,7 +101,7 @@ jobs:
     name: Lint TypeScript files
     runs-on: ubuntu-22.04
     needs: changes
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.ci == 'true' || needs.changes.outputs.npm == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
@@ -144,7 +144,7 @@ jobs:
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
       - run: npm run test:unit
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         if: success()
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -156,6 +156,7 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       DISABLE_V8_COMPILE_CACHE: 1
       VERSION: 0.0.0
+      VSCODE_ARCH: x64
       VSCODE_TARGET: linux-x64
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ELECTRON_SKIP_BINARY_DOWNLOAD: 1
@@ -179,13 +180,13 @@ jobs:
           cache-dependency-path: |
             package-lock.json
             test/package-lock.json
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-      - run: npm run build
+
       # Get Code's git hash.  When this changes it means the content is
       # different and we need to rebuild.
       - name: Get latest lib/vscode rev
         id: vscode-rev
         run: echo "rev=$(git rev-parse HEAD:./lib/vscode)" >> $GITHUB_OUTPUT
+
       # We need to rebuild when we have a new version of Code, when any of the
       # patches changed, or when the code-server version changes (since it gets
       # embedded into the code).  Use VSCODE_CACHE_VERSION to force a rebuild.
@@ -198,10 +199,21 @@ jobs:
       - name: Build vscode
         if: steps.cache-vscode.outputs.cache-hit != 'true'
         run: |
-          pushd lib/vscode
+          cd lib/vscode/build
           npm ci
-          popd
+          cd ..
+          source ./build/azure-pipelines/linux/setup-env.sh
+          # Run preinstall script before root dependencies are installed
+          # so that v8 headers are patched correctly for native modules.
+          node build/npm/preinstall.ts
+          npm ci
+          cd ../..
           npm run build:vscode
+
+      # Build the code-server wrapper.
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npm run build
+
       # Push up an artifact containing the linux-x64 release.
       - run: KEEP_MODULES=1 npm run release
       - run: tar -czf package.tar.gz release

.github/workflows/publish.yaml

@@ -83,7 +83,7 @@ jobs:
           git push --force
 
       - name: Validate package
-        uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
+        uses: heyhusen/archlinux-package-action@3f7aaada28c782497bfe02d6d6ea365b25fdea12 # v3.0.1
         with:
           pkgver: ${{ env.VERSION }}
           updpkgsums: true
@@ -109,8 +109,8 @@ jobs:
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:

.github/workflows/release.yaml

@@ -79,6 +79,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           submodules: true
+          # When an update/ branch is merged, a release is automatically created
+          # which requires secrets.
+          allow-unsafe-pr-checkout: true
       - run: quilt push -a
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
@@ -110,7 +113,7 @@ jobs:
       - run: |
           sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
         if: ${{ matrix.vscode_arch == 'x64' }}
-      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
@@ -123,7 +126,7 @@ jobs:
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
       - run: npm run package
-      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
@@ -173,6 +176,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           submodules: true
+          # When an update/ branch is merged, a release is automatically created
+          # which requires secrets.
+          allow-unsafe-pr-checkout: true
       - run: quilt push -a
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
@@ -189,6 +195,158 @@ jobs:
       - run: npm run test:native
 
       - run: npm run package
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          draft: true
+          discussion_category_name: "📣 Announcements"
+          files: ./release-packages/*
+          tag_name: v${{ env.VERSION }}
+          name: v${{ env.VERSION }}
+
+  package-windows:
+    name: win32-x64
+    runs-on: windows-2022
+    if: >-
+      (github.event_name == 'workflow_dispatch') ||
+      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/'))
+
+    defaults:
+      run:
+        shell: bash
+
+    env:
+      VSCODE_TARGET: win32-x64
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }}
+      # Ensure native modules are built from source to avoid prebuilds.
+      npm_config_build_from_source: true
+      OS: windows
+
+    steps:
+      # Git rewrites line endings on windows by default, which turns every
+      # shell script the build is made of into one bash cannot read, and
+      # every name in patches/series into one with a stray return.
+      - name: Keep line endings as they are in the repository
+        run: git config --global core.autocrlf false
+
+      - name: Strip update/ and v from tag and set major version
+        run: |
+          version=${TAG#update/}
+          version=${version#v}
+          version=4${version:1}
+          echo "VERSION=$version" >> $GITHUB_ENV
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          submodules: true
+          # When an update/ branch is merged, a release is automatically created
+          # which requires secrets.
+          allow-unsafe-pr-checkout: true
+
+      # quilt has no windows build. The patches are ordinary -p1 diffs
+      # against the repository root, so git applies them in series order.
+      - name: Apply patches
+        run: |
+          while read -r patch; do
+            case "$patch" in '' | '#'*) continue ;; esac
+            echo "applying $patch"
+            git apply --whitespace=nowarn "patches/$patch"
+          done < patches/series
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            test/package-lock.json
+
+      # npm hands every script it runs to cmd, which cannot run the shell
+      # scripts this repository is built out of. Point it at the same bash
+      # the steps here use rather than at a path, which moves between
+      # images.
+      - name: Let npm run shell scripts
+        run: echo "npm_config_script_shell=$(cygpath -w "$(command -v bash)")" >> $GITHUB_ENV
+
+      # The build merges json by handing jq a process substitution, which
+      # bash presents as a file under /dev/fd. The jq on this image is a
+      # windows program and cannot open those, so it reads the second input
+      # as nothing and the merge fails. Both the product and the package
+      # merge go through here.
+      - name: Let jq read what bash hands it
+        run: |
+          mkdir -p "$RUNNER_TEMP/shim"
+          cat > "$RUNNER_TEMP/shim/jq" <<'SHIM'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          args=()
+          for arg in "$@"; do
+            case $arg in
+              /dev/fd/* | /proc/*/fd/*)
+                copy=$(mktemp)
+                cat "$arg" > "$copy"
+                args+=("$copy")
+                ;;
+              *) args+=("$arg") ;;
+            esac
+          done
+          exec jq.exe "${args[@]}"
+          SHIM
+          chmod +x "$RUNNER_TEMP/shim/jq"
+          echo "$RUNNER_TEMP/shim" >> $GITHUB_PATH
+
+      # Stamping version details into the native binaries clears any
+      # signature they arrived with and asks signtool whether there is one.
+      # That only reads and removes, so it wants no certificate and signs
+      # nothing. It just has to be findable, and the sdk carrying it is not
+      # on the path.
+      - name: Put signtool on the path
+        run: |
+          sdk=$(ls -d "/c/Program Files (x86)/Windows Kits/10/bin"/*/x64 | sort -V | tail -1)
+          test -x "$sdk/signtool.exe"
+          cygpath -w "$sdk" >> $GITHUB_PATH
+
+      # build-release.sh copies the tree with rsync, which neither windows
+      # nor the git bash on this image has. MSYS2 is already here, just not
+      # on the path.
+      - name: Install rsync
+        shell: cmd
+        run: C:\msys64\usr\bin\pacman -Sy --noconfirm --needed rsync
+
+      # Only rsync crosses over. Putting msys2's /usr/bin in front instead
+      # breaks the release step: npm on the path is a shell script whose
+      # shebang reads /usr/bin/env bash, so with msys2 first it is msys2's
+      # bash that runs it, and crossing into a second msys runtime does not
+      # carry the environment. npm then sees no script-shell and falls back
+      # to cmd, which cannot run ./ci/build/build-release.sh, and
+      # KEEP_MODULES is dropped on the way. A forwarder avoids the whole
+      # class: rsync is a native exe that loads its runtime from beside
+      # itself, and nothing else on the path moves.
+      - name: Reach rsync without moving the path
+        run: |
+          cat > "$RUNNER_TEMP/shim/rsync" <<'SHIM'
+          #!/usr/bin/env bash
+          exec /c/msys64/usr/bin/rsync.exe "$@"
+          SHIM
+          chmod +x "$RUNNER_TEMP/shim/rsync"
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm run build:vscode
+      - run: KEEP_MODULES=1 npm run release
+
+      # Of the two tars on this image it is git bash's GNU one that can
+      # rename the tree's top directory as it archives; the windows bsdtar
+      # is built without substitution support. Asserted rather than
+      # assumed, since the two are interchangeable everywhere except here.
+      - name: Package
+        run: |
+          case "$(tar --version | head -1)" in
+            *GNU*) ;;
+            *) echo "expected GNU tar for --transform, got $(tar --version | head -1)" >&2; exit 1 ;;
+          esac
+          npm run package
+
       - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true

.github/workflows/security.yaml

@@ -51,7 +51,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # latest
+        uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -80,13 +80,13 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           config-file: ./.github/codeql-config.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

.github/workflows/trivy-docker.yaml

@@ -49,7 +49,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
       - name: Run Trivy vulnerability scanner in image mode
-        uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # latest
+        uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest
         with:
           image-ref: "docker.io/codercom/code-server:latest"
           ignore-unfixed: true

.node-version

@@ -1 +1 @@
-24.18.1
+24.22.1

CHANGELOG.md

@@ -22,6 +22,114 @@ Code v99.99.999
 
 ## Unreleased
 
+## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
+
+Code v1.143.1
+
+### Changed
+
+- Update to Code 1.143.1
+
+## [4.141.1](https://github.com/coder/code-server/releases/tag/v4.141.1) - 2026-10-23
+
+### Security
+
+- Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the
+  Brotli decoder (CVE-2026-111497).
+- Reject compressed request bodies (`Content-Encoding: br`, `gzip`, or
+  `deflate`) instead of decompressing them.
+
+### Fixed
+
+- Boolean flags in the `--flag=false` form and in the config file now respect
+  being set to false.
+
+### Added
+
+- Turkish locale.
+
+### Changed
+
+- Expand values from path options in the config file that start with a tilde.
+
+## [4.141.0](https://github.com/coder/code-server/releases/tag/v4.141.0) - 2026-10-08
+
+Code v1.141.0
+
+### Added
+
+- A new `--enable-remote-storage` flag can be used to make code-server persist
+  workbench storage on the remote server instead of browser storage. Use this if
+  you want to share storage between multiple devices.
+
+### Fixed
+
+- The Typescript extension was trying to load as a browser extension even though
+  we build the remote server version, causing it to fail to activate.
+
+### Changed
+
+- Update to Code 1.141.0
+
+## [4.140.0](https://github.com/coder/code-server/releases/tag/v4.140.0) - 2026-10-02
+
+Code v1.140.0
+
+### Changed
+
+- Update to Code 1.140.0
+
+## [4.139.1](https://github.com/coder/code-server/releases/tag/v4.139.1) - 2026-09-26
+
+Code v1.139.1
+
+### Changed
+
+- Update to Code 1.139.1
+
+### Fixed
+
+- `--idle-timeout-seconds` was only validated when passed as
+  `--idle-timeout-seconds=<value>`; values of 60 or less passed as
+  `--idle-timeout-seconds <value>` were silently accepted.
+
+## [4.138.0](https://github.com/coder/code-server/releases/tag/v4.138.0) - 2026-09-19
+
+Code v1.138.0
+
+### Changed
+
+- Update to Code 1.138.0
+
+### Fixed
+
+- Preserve the original path, query parameters, and fragment when rewriting
+  localhost URLs through the port proxy. If `VSCODE_PROXY_URI` has any query
+  parameters or fragments, those will be lost.
+
+## [4.137.0](https://github.com/coder/code-server/releases/tag/v4.137.0) - 2026-09-11
+
+Code v1.137.0
+
+### Changed
+
+- Update to Code 1.137.0
+
+## [4.136.2](https://github.com/coder/code-server/releases/tag/v4.136.2) - 2026-09-08
+
+Code v1.136.1
+
+### Changed
+
+- Update to Code 1.136.1
+
+### Fixed
+
+- 4.136.2 replaces a removed 4.136.1 release that had the data path incorrectly
+  being set to `~/.vscode-server-oss/data`.
+
+## [4.135.0](https://github.com/coder/code-server/releases/tag/v4.135.0) - 2026-08-27
+
 Code v1.135.0
 
 ### Changed

ci/build/build-packages.sh

@@ -25,7 +25,7 @@ main() {
 
 release_archive() {
   local release_name="code-server-$VERSION-$OS-$ARCH"
-  if [[ $OS == "linux" ]]; then
+  if [[ $OS == "linux" || $OS == "windows" ]]; then
     tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"
   else
     tar -czf "release-packages/$release_name.tar.gz" -s "/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"

ci/build/build-release.sh

@@ -41,6 +41,11 @@ main() {
     rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server"
     chmod 755 "$RELEASE_PATH/bin/code-server"
 
+    # Windows cannot run the shell launcher, so it gets one of its own.
+    if [ "$OS" = windows ]; then
+      rsync ./ci/build/code-server.cmd "$RELEASE_PATH/bin/code-server.cmd"
+    fi
+
     # Delete the extra bin scripts.
     rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-darwin.sh"
     rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-linux.sh"
@@ -111,6 +116,7 @@ bundle_vscode() {
 
   # Exclude Node since we want to place it in a directory above.
   rsync_opts+=(--exclude /node)
+  rsync_opts+=(--exclude /node.exe)
 
   # Exclude Node modules.  Note that these will already only include production
   # dependencies, so if we do keep them there is no need to do any
@@ -123,7 +129,11 @@ bundle_vscode() {
 
   # Copy the Node binary.
   if [[ $KEEP_MODULES = 1 ]]; then
-    cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib"
+    if [ "$OS" = windows ]; then
+      cp "./lib/vscode-reh-web-$VSCODE_TARGET/node.exe" "$RELEASE_PATH/lib"
+    else
+      cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib"
+    fi
   fi
 
   # Merge the package.json for the web/remote server so we can include

ci/build/build-vscode.sh

@@ -24,6 +24,7 @@ fix-bin-script() {
   # Fix Node path on Windows.
   sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$script"
   sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$script"
+  sed -i.bak 's/%ROOT_DIR%\\node.exe/%ROOT_DIR%\\lib\\node.exe/g' "$script"
 
   chmod +x "$script"
   rm "$script.bak"
@@ -57,10 +58,17 @@ main() {
     exit 1
   fi
 
-  # Add the date, our name, links, enable telemetry (this just makes telemetry
-  # available; telemetry can still be disabled by flag or setting), and
-  # configure trusted extensions (since some, like github.copilot-chat, never
-  # ask to be trusted and this is the only way to get auth working).
+  # Modify the product.json:
+  # - Add the date
+  # - Set the code-server name.
+  # - Add our links
+  # - Enable telemetry (this just makes telemetry available; telemetry can still
+  #   be disabled by flag or setting)
+  # - Configure trusted extensions (since some, like github.copilot-chat, never
+  #   ask to be trusted and this is the only way to get auth working).
+  # - Make Typescript server plugins run in the workspace.  We build the remote
+  #   server version, so there is no browser distribution, and this key is not
+  #   added automatically.
   #
   # This needs to be done before building as Code will read this file and embed
   # it into the client-side code.
@@ -102,6 +110,9 @@ main() {
     ],
     "aiConfig": {
       "ariaKey": "code-server"
+    },
+    "extensionPointExtensionKind": {
+      "typescriptServerPlugins": ["workspace"]
     }
   }
 EOF
@@ -132,7 +143,7 @@ EOF
   # Set vars and fix paths.
   case $OS in
     windows)
-      fix-bin-script remote-cli/code.cmd
+      fix-bin-script remote-cli/code-server.cmd
       fix-bin-script helpers/browser.cmd
       ;;
     *)

ci/build/code-server.cmd

@@ -0,0 +1,8 @@
+@echo off
+
+rem This script is intended to be bundled into the standalone releases.
+rem Runs code-server with the bundled node binary.
+
+setlocal
+set "ROOT=%~dp0.."
+"%ROOT%\lib\node.exe" "%ROOT%" %*

ci/build/npm-postinstall.sh

@@ -18,7 +18,7 @@ symlink() {
   dest="$2"
   rm -rf "$dest"
   case $OS in
-    windows) mklink /J "$dest" "$source" ;;
+    windows) cmd //c mklink //J "$dest" "$source" ;;
     *) ln -s "$source" "$dest" ;;
   esac
 }
@@ -67,7 +67,7 @@ main() {
 
   if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-24}" ]; then
     echo "ERROR: code-server currently requires node v24."
-    if [ -n "$FORCE_NODE_VERSION" ]; then
+    if [ -n "${FORCE_NODE_VERSION:-}" ]; then
       echo "However, you have overrided the version check to use v$FORCE_NODE_VERSION."
     fi
     echo "We have detected that you are on node v$major_node_version"

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.49.0
+version: 3.57.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.134.0
+appVersion: 4.143.1

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.134.0'
+  tag: '4.143.1'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a

ci/lib.sh

@@ -49,7 +49,10 @@ if [[ ! ${ARCH-} ]]; then
   export ARCH
 fi
 
-if [[ ! ${OS-} ]]; then
+# Windows predefines OS as Windows_NT for every process, so on a windows shell
+# the check below would always find a value and never call os(). That is not a
+# name this build knows, so it does not count as one the caller chose.
+if [[ ! ${OS-} || ${OS-} == "Windows_NT" ]]; then
   OS=$(os)
   export OS
 fi

docs/guide.md

@@ -9,6 +9,7 @@
   - [Using Let's Encrypt with NGINX](#using-lets-encrypt-with-nginx)
   - [Using a self-signed certificate](#using-a-self-signed-certificate)
   - [TLS 1.3 and Safari](#tls-13-and-safari)
+  - [Cloudflare Rocket Loader](#cloudflare-rocket-loader)
 - [External authentication](#external-authentication)
 - [HTTPS and self-signed certificates](#https-and-self-signed-certificates)
 - [Accessing web services](#accessing-web-services)
@@ -269,6 +270,26 @@ than TLS 1.3 you will need to add support for TLS 1.2 since Safari does not
 support TLS 1.3 for web sockets at the time of writing. If this is the case you
 should see OSSStatus: 9836 in the browser console.
 
+### Cloudflare Rocket Loader
+
+If you serve code-server through Cloudflare, disable Rocket Loader for that
+hostname. Rocket Loader rewrites inline `<script>` tags at the edge and
+re-injects them from its own loader, and the re-injected scripts do not carry
+the nonce in code-server's Content Security Policy, so the browser blocks them.
+The result is a blank page: every request returns HTTP 200 and the server logs
+look healthy, and the only console output is `Cannot determine URI for module
+id!`.
+
+Scope it with a Configuration Rule rather than turning it off zone-wide:
+
+```
+Expression: (http.host eq "code.example.com")
+Setting:    Rocket Loader -> Off
+```
+
+Adding `'unsafe-inline'` to the policy does not help, because CSP ignores it
+whenever a nonce or hash is present.
+
 ## External authentication
 
 If you want to use external authentication mechanism (e.g., Sign in with

docs/helm.md

@@ -1,6 +1,6 @@
 # code-server Helm Chart
 
-[![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square)](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.8.0](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.8.0-informational?style=flat-square)
+[![Version: 3.54.0](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square)](https://img.shields.io/badge/Version-3.54.0-informational?style=flat-square) [![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)](https://img.shields.io/badge/Type-application-informational?style=flat-square) [![AppVersion: 4.139.1](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)](https://img.shields.io/badge/AppVersion-4.139.1-informational?style=flat-square)
 
 [code-server](https://github.com/coder/code-server) code-server is VS Code running
 on a remote server, accessible through the browser.
@@ -62,10 +62,12 @@ and their default values.
 | Key                                         | Type   | Default                  |
 | ------------------------------------------- | ------ | ------------------------ |
 | affinity                                    | object | `{}`                     |
+| annotations                                 | object | `{}`                     |
 | extraArgs                                   | list   | `[]`                     |
 | extraConfigmapMounts                        | list   | `[]`                     |
 | extraContainers                             | string | `""`                     |
 | extraInitContainers                         | string | `""`                     |
+| extraPorts                                  | list   | `[]`                     |
 | extraSecretMounts                           | list   | `[]`                     |
 | extraVars                                   | list   | `[]`                     |
 | extraVolumeMounts                           | list   | `[]`                     |
@@ -73,26 +75,32 @@ and their default values.
 | hostnameOverride                            | string | `""`                     |
 | image.pullPolicy                            | string | `"Always"`               |
 | image.repository                            | string | `"codercom/code-server"` |
-| image.tag                                   | string | `"4.8.0"`                |
+| image.tag                                   | string | `"4.139.1"`              |
 | imagePullSecrets                            | list   | `[]`                     |
 | ingress.enabled                             | bool   | `false`                  |
+| ingress.ingressClassName                    | string | `""`                     |
+| lifecycle.enabled                           | bool   | `false`                  |
+| livenessProbe.enabled                       | bool   | `true`                   |
 | nameOverride                                | string | `""`                     |
 | nodeSelector                                | object | `{}`                     |
 | persistence.accessMode                      | string | `"ReadWriteOnce"`        |
 | persistence.annotations                     | object | `{}`                     |
 | persistence.enabled                         | bool   | `true`                   |
-| persistence.size                            | string | `"1Gi"`                  |
+| persistence.size                            | string | `"10Gi"`                 |
 | podAnnotations                              | object | `{}`                     |
 | podSecurityContext                          | object | `{}`                     |
+| priorityClassName                           | string | `""`                     |
+| readinessProbe.enabled                      | bool   | `true`                   |
 | replicaCount                                | int    | `1`                      |
 | resources                                   | object | `{}`                     |
 | securityContext.enabled                     | bool   | `true`                   |
 | securityContext.fsGroup                     | int    | `1000`                   |
 | securityContext.runAsUser                   | int    | `1000`                   |
-| service.port                                | int    | `8443`                   |
+| service.port                                | int    | `8080`                   |
 | service.type                                | string | `"ClusterIP"`            |
+| serviceAccount.annotations                  | object | `{}`                     |
 | serviceAccount.create                       | bool   | `true`                   |
-| serviceAccount.name                         | string | `nil`                    |
+| serviceAccount.name                         | string | `""`                     |
 | tolerations                                 | list   | `[]`                     |
 | volumePermissions.enabled                   | bool   | `true`                   |
 | volumePermissions.securityContext.runAsUser | int    | `0`                      |
@@ -114,7 +122,7 @@ can be provided while installing the chart. For example,
 $ helm upgrade --install code-server ci/helm-chart -f values.yaml
 ```
 
-> **Tip**: You can use the default [values.yaml](values.yaml)
+> **Tip**: You can use the default [values.yaml](../ci/helm-chart/values.yaml)
 
 # Extra Containers
 

package-lock.json

@@ -21,7 +21,7 @@
         "httpolyglot": "^0.1.2",
         "i18next": "^26.3.1",
         "js-yaml": "^5.2.3",
-        "limiter": "^2.1.0",
+        "limiter": "^4.1.0",
         "pem": "^1.14.8",
         "proxy-agent": "^6.3.1",
         "qs": "^6.15.0",
@@ -59,7 +59,7 @@
         "eslint-plugin-prettier": "^5.0.0",
         "globals": "^17.6.0",
         "prettier": "3.9.4",
-        "prettier-plugin-sh": "^0.18.0",
+        "prettier-plugin-sh": "^0.20.2",
         "ts-node": "^10.9.1",
         "typescript": "^5.6.2",
         "typescript-eslint": "^8.8.0"
@@ -329,29 +329,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -444,15 +458,80 @@
       }
     },
     "node_modules/@reteps/dockerfmt": {
-      "version": "0.3.6",
-      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.3.6.tgz",
-      "integrity": "sha512-Tb5wIMvBf/nLejTQ61krK644/CEMB/cpiaIFXqGApfGqO3GwcR3qnI0DbmkFVCl2OyEp8LnLX3EkucoL0+tbFg==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt/-/dockerfmt-0.5.4.tgz",
+      "integrity": "sha512-HEGgXVVOb+JtGUSSzXl/XPKFIZjMDTUoHarCjaQdkY+cb5M9K/O3b5xm+x0IPIk3SfHurbc0bSgcFsQlzjitxA==",
       "dev": true,
       "license": "MIT",
+      "bin": {
+        "dockerfmt": "dist/launcher.js"
+      },
       "engines": {
         "node": "^v12.20.0 || ^14.13.0 || >=16.0.0"
+      },
+      "optionalDependencies": {
+        "@reteps/dockerfmt-darwin-arm64": "0.5.4",
+        "@reteps/dockerfmt-darwin-x64": "0.5.4",
+        "@reteps/dockerfmt-linux-arm64": "0.5.4",
+        "@reteps/dockerfmt-linux-x64": "0.5.4"
       }
     },
+    "node_modules/@reteps/dockerfmt-darwin-arm64": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-darwin-arm64/-/dockerfmt-darwin-arm64-0.5.4.tgz",
+      "integrity": "sha512-urMqV+dQyvVI8/WrXwClX9e1PEyS35wFdwJjpZYmL09AkV4Io5U1oam8UBKK7jZk0+YsdF88ay6e86Kn6DIyQg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@reteps/dockerfmt-darwin-x64": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-darwin-x64/-/dockerfmt-darwin-x64-0.5.4.tgz",
+      "integrity": "sha512-fJORy6DFxbgDiMqxpLTPZlb5KUY0Vq0iR4NGnyKnuYZ9LdZUS508DK2kt/AJ87/jIKNV1qRG0JXG1Tc6xdvWjw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@reteps/dockerfmt-linux-arm64": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-linux-arm64/-/dockerfmt-linux-arm64-0.5.4.tgz",
+      "integrity": "sha512-6pVakO06eXtDuvxy1Dnjs/gQyUoGGycle8PRSt5IFRwLi/AVaOQwfkfmW0WP8VH9wNUeti6BfJ3ksTn2G+XMxg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@reteps/dockerfmt-linux-x64": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@reteps/dockerfmt-linux-x64/-/dockerfmt-linux-x64-0.5.4.tgz",
+      "integrity": "sha512-OD6SIlUV1D4TgJoTui3FMBAZsGbTSPYsiT0BKhD6jMUcJb3GpFTa7dY9rL8rP9FUqfL7OTHVUGUOL4Rh64Olog==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
     "node_modules/@rtsao/scc": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@rtsao/scc/-/scc-1.1.0.tgz",
@@ -726,9 +805,9 @@
       "license": "MIT"
     },
     "node_modules/@types/semver": {
-      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -778,17 +857,17 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.1.tgz",
-      "integrity": "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.69.0.tgz",
+      "integrity": "sha512-t5jQTKPIgVW1PE6dR6H6Qz5gm8zjMlX5/2gRaOGd9eO6V7J+tQc6iWKukEe7dY8u9HyYasQ0yfF0/FSSTEO2gA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/type-utils": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/type-utils": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -801,15 +880,15 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.61.1",
+        "@typescript-eslint/parser": "^8.69.0",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+      "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -817,16 +896,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.1.tgz",
-      "integrity": "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.69.0.tgz",
+      "integrity": "sha512-l4b0DhWioGg6Gt2ebGlvfkFMOjRsauxtsnDRwUSRX1qHq3HdTfQHV8wW9zEXeciai6HfeaKOedQn2Zoofx3WBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -842,14 +921,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
-      "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.69.0.tgz",
+      "integrity": "sha512-yi4obFrHMmnsesWehHbkg9zMA7Jt8cXT+mKM08G999pH1yT6nqgsHx7MYm0uY1wAj8CqiBXYRJ7WAT0QdQHQXg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.61.1",
-        "@typescript-eslint/types": "^8.61.1",
+        "@typescript-eslint/tsconfig-utils": "^8.69.0",
+        "@typescript-eslint/types": "^8.69.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -864,14 +943,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
-      "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.69.0.tgz",
+      "integrity": "sha512-ewfspqWvSxKSOaplqAUNbaSFO0eB6w1EtQ+esfYFRm3614Ty4uNtExkcbgd6nWsXphbqKyf9ZYdbZdv2xEoWEQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1"
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -882,9 +961,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
-      "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.69.0.tgz",
+      "integrity": "sha512-xNqK7YTDZsLniQMV/4rpFR8Z5JlqeRvVjuG1YgF/mdPVH84HSD19L8CczMA0qg2RfwEV231GHH3VnToJDo4MfQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -899,15 +978,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.1.tgz",
-      "integrity": "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.69.0.tgz",
+      "integrity": "sha512-ZfoJAVg3JZndQEpEl9petVlxau3lRuElc4HRMuAlLCf8to04/iHz692RUSNmXKDjEuJmIL+KZ2/BsOcBc16dsA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -924,9 +1003,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
-      "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -938,16 +1017,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
-      "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.69.0.tgz",
+      "integrity": "sha512-AdFkgqck3Vudb/kWnxlyafU/4aBhHrbQ9locP2N4psXTy5mOBg0SHJumnLvx7r6g1gV4DKvUFwV2nJZBoqOD8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.61.1",
-        "@typescript-eslint/tsconfig-utils": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/visitor-keys": "8.61.1",
+        "@typescript-eslint/project-service": "8.69.0",
+        "@typescript-eslint/tsconfig-utils": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/visitor-keys": "8.69.0",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -976,9 +1055,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -989,13 +1068,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.5"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -1005,16 +1084,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.1.tgz",
-      "integrity": "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.69.0.tgz",
+      "integrity": "sha512-tUbx60BBqQa31kXF5MCsOOLL5E/WzUuxIn7YpAvq+eaUlqvk8/NXnXMBNAdLCr0icjkzem7iUA5QqWHe/hJ1aw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.61.1",
-        "@typescript-eslint/types": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1"
+        "@typescript-eslint/scope-manager": "8.69.0",
+        "@typescript-eslint/types": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1029,13 +1108,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
-      "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.69.0.tgz",
+      "integrity": "sha512-+rmdgPA+EXkNgKYvHvFfhrs35utXbwaC5PGpDquSXcoXQDKUA5UjV0LmTucG/4JXkM31BTu4TilHtrN8IVBe8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/types": "8.69.0",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -1700,9 +1779,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1902,14 +1981,15 @@
       }
     },
     "node_modules/compression": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
+      "integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
         "compressible": "~2.0.18",
         "debug": "2.6.9",
+        "destroy": "1.2.0",
         "negotiator": "~0.6.4",
         "on-headers": "~1.1.0",
         "safe-buffer": "5.2.1",
@@ -1917,6 +1997,10 @@
       },
       "engines": {
         "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/compression/node_modules/debug": {
@@ -2197,6 +2281,16 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
     "node_modules/diff": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
@@ -3683,9 +3777,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.7.2",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.2.tgz",
+      "integrity": "sha512-7H/2gFSIitxc0hG3nOI1glS8QLo/EHBFFLk8vEUjXY/xu0AdL8jZ9U1IzO2PUm0d2D/ofQcAifb0g6OBkt8U7w==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -4176,9 +4270,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
       "funding": [
         {
           "type": "github",
@@ -4231,12 +4325,6 @@
         "json5": "lib/cli.js"
       }
     },
-    "node_modules/just-performance": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/just-performance/-/just-performance-4.3.0.tgz",
-      "integrity": "sha512-L7RjvtJsL0QO8xFs5wEoDDzzJwoiowRw6Rn/GnvldlchS2JQr9wFYPiwZcDfrbbujEKqKN0tvENdbjXdYhDp5Q==",
-      "license": "MIT"
-    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -4262,13 +4350,10 @@
       }
     },
     "node_modules/limiter": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/limiter/-/limiter-2.1.0.tgz",
-      "integrity": "sha512-361TYz6iay6n+9KvUUImqdLuFigK+K79qrUtBsXhJTLdH4rIt/r1y8r1iozwh8KbZNpujbFTSh74mJ7bwbAMOw==",
-      "license": "MIT",
-      "dependencies": {
-        "just-performance": "4.3.0"
-      }
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/limiter/-/limiter-4.1.0.tgz",
+      "integrity": "sha512-dx+FIOmHyJSBT6CTOPrVmhcwhfK2cDjM7d0p6oghDYJeMMfGDIVM/83qX+EM9MgQpRxEwu9QLsScocXIWqz+VA==",
+      "license": "MIT"
     },
     "node_modules/locate-path": {
       "version": "6.0.0",
@@ -5209,14 +5294,14 @@
       }
     },
     "node_modules/prettier-plugin-sh": {
-      "version": "0.18.0",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.18.0.tgz",
-      "integrity": "sha512-cW1XL27FOJQ/qGHOW6IHwdCiNWQsAgK+feA8V6+xUTaH0cD3Mh+tFAtBvEEWvuY6hTDzRV943Fzeii+qMOh7nQ==",
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-sh/-/prettier-plugin-sh-0.20.2.tgz",
+      "integrity": "sha512-4QVyY7Vav0f5i6AVa80SFwUJXaWsAv9t0yUZIivwI0ucxTei6Jwhso/khWqaKDj4QGdwjP2py1nxQrDUeZ0jyQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@reteps/dockerfmt": "^0.3.6",
-        "sh-syntax": "^0.5.8"
+        "@reteps/dockerfmt": "^0.5.4",
+        "sh-syntax": "^0.7.0"
       },
       "engines": {
         "node": ">=16.0.0"
@@ -5229,9 +5314,9 @@
       }
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -5239,6 +5324,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-agent": {
@@ -5277,12 +5366,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -5601,9 +5691,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -5713,14 +5803,11 @@
       "license": "ISC"
     },
     "node_modules/sh-syntax": {
-      "version": "0.5.8",
-      "resolved": "https://registry.npmjs.org/sh-syntax/-/sh-syntax-0.5.8.tgz",
-      "integrity": "sha512-JfVoxf4FxQI5qpsPbkHhZo+n6N9YMJobyl4oGEUBb/31oQYlgTjkXQD8PBiafS2UbWoxrTO0Z5PJUBXEPAG1Zw==",
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/sh-syntax/-/sh-syntax-0.7.0.tgz",
+      "integrity": "sha512-sgMyAxpHiGgAaNg+gD3ad41vha24CzIjjghD4mdiON1lUafZPLJNYknyjcXmU4geilPstd69zCKkpccY0YvajA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.8.1"
-      },
       "engines": {
         "node": ">=16.0.0"
       },
@@ -5750,14 +5837,14 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -5769,13 +5856,13 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"
@@ -6286,16 +6373,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.61.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.1.tgz",
-      "integrity": "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.69.0.tgz",
+      "integrity": "sha512-B3MltX0VqjUBNEe3b3sSuiRbfa6XrfHFtBiPamjT5AsW/dfq+y+bc0wyuS9DxAS1LyzCxRp2+rxzpLUvqM2BvA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.61.1",
-        "@typescript-eslint/parser": "8.61.1",
-        "@typescript-eslint/typescript-estree": "8.61.1",
-        "@typescript-eslint/utils": "8.61.1"
+        "@typescript-eslint/eslint-plugin": "8.69.0",
+        "@typescript-eslint/parser": "8.69.0",
+        "@typescript-eslint/typescript-estree": "8.69.0",
+        "@typescript-eslint/utils": "8.69.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"

package.json

@@ -60,7 +60,7 @@
     "eslint-plugin-prettier": "^5.0.0",
     "globals": "^17.6.0",
     "prettier": "3.9.4",
-    "prettier-plugin-sh": "^0.18.0",
+    "prettier-plugin-sh": "^0.20.2",
     "ts-node": "^10.9.1",
     "typescript": "^5.6.2",
     "typescript-eslint": "^8.8.0"
@@ -77,7 +77,7 @@
     "httpolyglot": "^0.1.2",
     "i18next": "^26.3.1",
     "js-yaml": "^5.2.3",
-    "limiter": "^2.1.0",
+    "limiter": "^4.1.0",
     "pem": "^1.14.8",
     "proxy-agent": "^6.3.1",
     "qs": "^6.15.0",

patches/app-name.diff

@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -24,6 +24,7 @@ export const serverOptions: OptionDescri
+@@ -40,6 +40,7 @@ export const serverOptions: OptionDescri
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
  	'link-protection-trusted-domains': { type: 'string[]' },
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -124,6 +125,7 @@ export interface ServerParsedArgs {
+@@ -140,6 +141,7 @@ export interface ServerParsedArgs {
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
  	'link-protection-trusted-domains'?: string[],
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -362,8 +362,11 @@ export class WebClientServer {
+@@ -407,8 +407,11 @@ export class WebClientServer {
  			linkProtectionTrustedDomains.push(...this._productService.linkProtectionTrustedDomains);
  		}
  

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -251,7 +251,9 @@ class RemoteAuthoritiesImpl {
+@@ -256,7 +256,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,
@@ -36,8 +36,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -27,9 +27,9 @@
- 		<meta id="vscode-workbench-builtin-extensions" data-settings="{{WORKBENCH_BUILTIN_EXTENSIONS}}">
+@@ -29,9 +29,9 @@
+ 		<meta id="vscode-workbench-css-modules" data-settings="{{WORKBENCH_DEV_CSS_MODULES}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
 -		<link rel="icon" href="/_static/src/browser/media/favicon-dark-support.svg" />
@@ -48,16 +48,16 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
 +		<link rel="manifest" href="{{VS_BASE}}/manifest.json" crossorigin="use-credentials" />
  		<style id="vscode-css-modules" type="text/css" media="screen"></style>
  
- 	</head>
-@@ -39,7 +39,7 @@
+ 		<!-- Startup fallback: shown only if the scripts below never run, e.g. because a proxy,
+@@ -92,7 +92,7 @@
  
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script>
--		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
-+		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+-		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
++		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script>
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
 Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.html
@@ -73,7 +73,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -24,9 +24,9 @@
+@@ -25,9 +25,9 @@
  		<meta id="vscode-workbench-auth-session" data-settings="{{WORKBENCH_AUTH_SESSION}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
@@ -85,16 +85,16 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 +		<link rel="manifest" href="{{VS_BASE}}/manifest.json" crossorigin="use-credentials" />
  		<link rel="stylesheet" href="{{WORKBENCH_WEB_BASE_URL}}/out/vs/code/browser/workbench/workbench.css">
  
- 	</head>
-@@ -36,7 +36,7 @@
+ 		<!-- Startup fallback: shown only if the scripts below never run, e.g. because a proxy,
+@@ -88,7 +88,7 @@
  
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script>
--		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
-+		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+-		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
++		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script>
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
 Index: code-server/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
@@ -111,21 +111,31 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -263,7 +263,9 @@ export class WebClientServer {
+@@ -146,7 +146,7 @@ export function createWorkbenchContentSe
+ 		'default-src \'self\';',
+ 		'img-src \'self\' https: data: blob:;',
+ 		'media-src \'self\';',
+-		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
++		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
+ 		'child-src \'self\';',
+ 		`frame-src 'self' https://*.vscode-cdn.net data:;`,
+ 		'worker-src \'self\' data: blob:;',
+@@ -307,8 +307,10 @@ export class WebClientServer {
  		};
  
  		// Prefix routes with basePath for clients
--		const basePath = getFirstHeader('x-forwarded-prefix') || this._basePath;
 +		const rootBase = relativeRoot(getOriginalUrl(req))
 +		const vscodeBase = relativePath(getOriginalUrl(req))
-+		const basePath = vscodeBase || getFirstHeader('x-forwarded-prefix') || this._basePath;
+ 		const forwardedPrefix = getFirstHeader('x-forwarded-prefix');
+-		const basePath = forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath;
++		const basePath = vscodeBase || (forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath);
  
  		const queryConnectionTokens = parsedUrl.searchParams.getAll(connectionTokenQueryName);
  		if (queryConnectionTokens.length === 1) {
-@@ -300,10 +302,14 @@ export class WebClientServer {
+@@ -345,10 +347,14 @@ export class WebClientServer {
  		};
  
- 		const useTestResolver = (!this._environmentService.isBuilt && this._environmentService.args['use-test-resolver']);
+ 		const useTestResolver = (!this._environmentService.isBuilt && !!this._environmentService.args['use-test-resolver']);
 +		// For now we are getting the remote authority from the client to avoid
 +		// needing specific configuration for reverse proxies to work.  Set this to
 +		// something invalid to make sure we catch code that is using this value
@@ -138,7 +148,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		);
  		if (!remoteAuthority) {
  			return serveError(req, res, 400, `Bad request.`);
-@@ -350,6 +356,7 @@ export class WebClientServer {
+@@ -395,6 +401,7 @@ export class WebClientServer {
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
@@ -146,27 +156,18 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,
  			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
-@@ -399,7 +406,9 @@ export class WebClientServer {
- 			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
+@@ -446,7 +453,9 @@ export class WebClientServer {
  			WORKBENCH_WEB_BASE_URL: staticRoute,
  			WORKBENCH_NLS_URL,
--			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`
-+			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
+ 			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
+-			WORKBENCH_SCRIPT_NONCE: scriptNonce
++			WORKBENCH_SCRIPT_NONCE: scriptNonce,
 +			BASE: rootBase,
 +			VS_BASE: basePath,
  		};
  
  		// DEV ---------------------------------------------------------------------------------------
-@@ -436,7 +445,7 @@ export class WebClientServer {
- 			'default-src \'self\';',
- 			'img-src \'self\' https: data: blob:;',
- 			'media-src \'self\';',
--			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
-+			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
- 			'child-src \'self\';',
- 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
- 			'worker-src \'self\' data: blob:;',
-@@ -509,3 +518,70 @@ export class WebClientServer {
+@@ -542,3 +551,70 @@ export class WebClientServer {
  		return void res.end(data);
  	}
  }
@@ -280,8 +281,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 -
  (function () {
  
- 	// Find config by checking for DOM
-@@ -610,8 +600,8 @@ function readCookie(name: string): strin
+ 	// This script running at all means the page scripts were not blocked or rewritten.
+@@ -614,8 +604,8 @@ function readCookie(name: string): strin
  	if (!configElement || !configElementAttribute) {
  		throw new Error('Missing web configuration element');
  	}

patches/clipboard.diff

@@ -78,7 +78,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
-@@ -147,6 +147,7 @@ export interface NativeParsedArgs {
+@@ -148,6 +148,7 @@ export interface NativeParsedArgs {
  	'disable-chromium-sandbox'?: boolean;
  	sandbox?: boolean;
  	'enable-coi'?: boolean;
@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/node/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
-@@ -115,6 +115,7 @@ export const OPTIONS: OptionDescriptions
+@@ -116,6 +116,7 @@ export const OPTIONS: OptionDescriptions
  	'user-data-dir': { type: 'string', cat: 'o', args: 'dir', description: localize('userDataDir', "Specifies the directory that user data is kept in. Can be used to open multiple distinct instances of Code.") },
  	'profile': { type: 'string', 'cat': 'o', args: 'profileName', description: localize('profileName', "Opens the provided folder or workspace with the given profile and associates the profile with the workspace. If the profile does not exist, a new empty one is created.") },
  	'help': { type: 'boolean', cat: 'o', alias: 'h', description: localize('help', "Print usage.") },

patches/copilot.diff

@@ -2,7 +2,7 @@ Index: code-server/lib/vscode/build/gulpfile.extensions.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
 +++ code-server/lib/vscode/build/gulpfile.extensions.ts
-@@ -291,6 +291,29 @@ export const compileCopilotExtensionBuil
+@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
  task.task(compileCopilotExtensionBuildTask);
  
  /**
@@ -44,7 +44,7 @@ Index: code-server/lib/vscode/build/lib/extensions.ts
  import watcher from './watch/index.ts';
  
  import { createRequire } from 'module';
-@@ -491,6 +492,116 @@ export function packageCopilotExtensionS
+@@ -487,6 +488,116 @@ export function packageCopilotExtensionS
  	).pipe(util2.setExecutableBit(['**/*.sh']));
  }
  

patches/csp-hashes.diff

@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-FFQoOVVa2tOE3uqUvirwaMNT20TZmrHcL2aaOjJ8BUo=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-24QqbpzqcqSyIGvg/ZwFRy5pPlhmVBa8CkUREEIUnBw=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-7cKy9iQfWRXcgRS74x6I4q5cRDkv8nQz51jecqMmQ5w=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-FYdHnaDkSHwSK3TmWDrs/tT+X4bK+aaoa9yy432BONk=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"

patches/disable-builtin-ext-update.diff

@@ -7,7 +7,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -343,6 +343,10 @@ export class Extension implements IExten
+@@ -344,6 +344,10 @@ export class Extension implements IExten
  			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
  				return false;
  			}

patches/display-language.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -417,6 +417,9 @@ export async function setupServerService
+@@ -444,6 +444,9 @@ export async function setupServerService
  
  		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
  
@@ -56,7 +56,7 @@ Index: code-server/lib/vscode/src/vs/server/node/remoteLanguagePacks.ts
  import type { INLSConfiguration } from '../../nls.js';
 @@ -33,7 +35,94 @@ export async function getNLSConfiguratio
  	if (!result) {
- 		result = resolveNLSConfiguration({ userLocale: language, osLocale: language, commit: product.commit, userDataPath, nlsMetadataPath });
+ 		result = resolveNLSConfiguration({ userLocale: language, osLocale: language, commit: product.commit, nlsMetadataHash: product.nlsMetadataHash, userDataPath, nlsMetadataPath });
  		nlsConfigurationCache.set(cacheKey, result);
 +		// If the language pack does not yet exist, it defaults to English, which is
 +		// then cached and you have to restart even if you then install the pack.
@@ -161,7 +161,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  import { CharCode } from '../../base/common/charCode.js';
  import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
  import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -397,14 +398,22 @@ export class WebClientServer {
+@@ -442,14 +443,22 @@ export class WebClientServer {
  		};
  
  		const cookies = cookie.parse(req.headers.cookie || '');
@@ -171,7 +171,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		let WORKBENCH_NLS_URL: string;
  		if (!locale.startsWith('en') && this._productService.nlsCoreBaseUrl) {
  			WORKBENCH_NLS_BASE_URL = this._productService.nlsCoreBaseUrl;
- 			WORKBENCH_NLS_URL = `${WORKBENCH_NLS_BASE_URL}${this._productService.commit}/${this._productService.version}/${locale}/nls.messages.js`;
+ 			WORKBENCH_NLS_URL = createNlsUrl(WORKBENCH_NLS_BASE_URL, this._productService.commit, this._productService.version, locale);
  		} else {
 -			WORKBENCH_NLS_URL = ''; // fallback will apply
 +			try {
@@ -181,16 +181,16 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 +					: '';
 +			} catch (error) {
 +				console.error("Failed to generate translations", error);
-+				WORKBENCH_NLS_URL = '';
++				WORKBENCH_NLS_URL = ''; // fallback will apply
 +			}
  		}
  
- 		const values: { [key: string]: string } = {
+ 		const scriptNonce = createScriptNonce();
 Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -22,6 +22,7 @@ export const serverOptions: OptionDescri
+@@ -38,6 +38,7 @@ export const serverOptions: OptionDescri
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
@@ -198,7 +198,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -120,6 +121,7 @@ export interface ServerParsedArgs {
+@@ -136,6 +137,7 @@ export interface ServerParsedArgs {
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
@@ -272,7 +272,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
-@@ -475,9 +475,6 @@ export class InstallAction extends Exten
+@@ -479,9 +479,6 @@ export class InstallAction extends Exten
  		if (this.extension.isBuiltin) {
  			return;
  		}
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		if (this.extension.state !== ExtensionState.Uninstalled) {
  			return;
  		}
-@@ -782,7 +779,7 @@ export abstract class InstallInOtherServ
+@@ -786,7 +783,7 @@ export abstract class InstallInOtherServ
  		}
  
  		if (isLanguagePackExtension(this.extension.local.manifest)) {
@@ -291,7 +291,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		}
  
  		// Prefers to run on UI
-@@ -2281,17 +2278,6 @@ export class SetLanguageAction extends E
+@@ -2285,17 +2282,6 @@ export class SetLanguageAction extends E
  	update(): void {
  		this.enabled = false;
  		this.class = SetLanguageAction.DisabledClass;
@@ -309,7 +309,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  	}
  
  	override async run(): Promise<any> {
-@@ -2308,7 +2294,6 @@ export class ClearLanguageAction extends
+@@ -2312,7 +2298,6 @@ export class ClearLanguageAction extends
  	private static readonly DisabledClass = `${this.EnabledClass} disabled`;
  
  	constructor(
@@ -317,7 +317,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		@ILocaleService private readonly localeService: ILocaleService,
  	) {
  		super(ClearLanguageAction.ID, ClearLanguageAction.TITLE.value, ClearLanguageAction.DisabledClass, false);
-@@ -2318,17 +2303,6 @@ export class ClearLanguageAction extends
+@@ -2322,17 +2307,6 @@ export class ClearLanguageAction extends
  	update(): void {
  		this.enabled = false;
  		this.class = ClearLanguageAction.DisabledClass;

patches/external-file-actions.diff

@@ -48,8 +48,8 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -34,6 +34,16 @@ export interface IBrowserWorkbenchEnviro
- 	readonly options?: IWorkbenchConstructionOptions;
+@@ -39,6 +39,16 @@ export interface IBrowserWorkbenchEnviro
+ 	readonly sessionTitle?: string;
  
  	/**
 +	 * Enable downloading files via menu actions.
@@ -65,7 +65,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
  	 * Gets whether a resolver extension is expected for the environment.
  	 */
  	readonly expectsResolverExtension: boolean;
-@@ -111,6 +121,20 @@ export class BrowserWorkbenchEnvironment
+@@ -116,6 +126,20 @@ export class BrowserWorkbenchEnvironment
  		return this.options.userDataPath;
  	}
  
@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -19,6 +19,8 @@ export const serverOptions: OptionDescri
+@@ -35,6 +35,8 @@ export const serverOptions: OptionDescri
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
  	'auth': { type: 'string' },
@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -114,6 +116,8 @@ export interface ServerParsedArgs {
+@@ -130,6 +132,8 @@ export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
  	'auth'?: string;
@@ -112,7 +112,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -380,6 +380,8 @@ export class WebClientServer {
+@@ -425,6 +425,8 @@ export class WebClientServer {
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
  			userDataPath: this._environmentService.userDataPath,
@@ -128,7 +128,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 @@ -6,10 +6,10 @@
  import { Disposable } from '../../base/common/lifecycle.js';
  import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
- import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
+ import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext, IsChromeOSContext } from '../../platform/contextkey/common/contextkeys.js';
 -import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SecondarySideBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext } from '../common/contextkeys.js';
 +import { IsEnabledFileDownloads, IsEnabledFileUploads, SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SecondarySideBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext } from '../common/contextkeys.js';
  import { preferredSideBySideGroupDirection, GroupDirection, IEditorGroupsService } from '../services/editor/common/editorGroupsService.js';
@@ -147,7 +147,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
  		@IProductService private readonly productService: IProductService,
  		@IEditorGroupsService private readonly editorGroupService: IEditorGroupsService,
  		@IEditorService private readonly editorService: IEditorService,
-@@ -205,6 +205,10 @@ export class WorkbenchContextKeysHandler
+@@ -206,6 +206,10 @@ export class WorkbenchContextKeysHandler
  		this.auxiliaryBarMaximizedContext = AuxiliaryBarMaximizedContext.bindTo(this.contextKeyService);
  		this.auxiliaryBarMaximizedContext.set(this.layoutService.isAuxiliaryBarMaximized());
  
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explorerViewer.ts
-@@ -65,6 +65,7 @@ import { timeout } from '../../../../../
+@@ -62,6 +62,7 @@ import { defaultCountBadgeStyles } from
  import { IFilesConfigurationService } from '../../../../services/filesConfiguration/common/filesConfigurationService.js';
  import { mainWindow } from '../../../../../base/browser/window.js';
  import { IExplorerFileContribution, explorerFileContribRegistry } from '../explorerFileContrib.js';
@@ -290,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
  import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
  import { CancellationToken } from '../../../../../base/common/cancellation.js';
-@@ -1587,7 +1588,8 @@ export class FileDragAndDrop implements
+@@ -1515,7 +1516,8 @@ export class FileDragAndDrop implements
  		@IConfigurationService private configurationService: IConfigurationService,
  		@IInstantiationService private instantiationService: IInstantiationService,
  		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -300,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  	) {
  		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
  			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1812,15 +1814,17 @@ export class FileDragAndDrop implements
+@@ -1740,15 +1742,17 @@ export class FileDragAndDrop implements
  
  			// External file DND (Import/Upload file)
  			if (data instanceof NativeDragAndDropData) {

patches/getting-started.diff

@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { renderFormattedText } from '../../../../base/browser/formattedTextRenderer.js';
  import { status } from '../../../../base/browser/ui/aria/aria.js';
  import { StandardKeyboardEvent } from '../../../../base/browser/keyboardEvent.js';
-@@ -54,7 +54,7 @@ import { IRecentFolder, IRecentWorkspace
+@@ -55,7 +55,7 @@ import { IRecentFolder, IRecentWorkspace
  import { OpenRecentAction } from '../../../browser/actions/windowActions.js';
  import { OpenFileFolderAction, OpenFolderAction, OpenFolderViaWorkspaceAction } from '../../../browser/actions/workspaceActions.js';
  import { EditorPane } from '../../../browser/parts/editor/editorPane.js';
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -928,6 +928,72 @@ export class GettingStartedPage extends
+@@ -930,6 +930,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -977,6 +1043,9 @@ export class GettingStartedPage extends
+@@ -980,6 +1046,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}
@@ -115,7 +115,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
 +++ code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/browser/media/gettingStarted.css
-@@ -60,6 +60,15 @@
+@@ -63,6 +63,15 @@
  	display: block;
  }
  
@@ -151,7 +151,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -44,6 +44,11 @@ export interface IBrowserWorkbenchEnviro
+@@ -49,6 +49,11 @@ export interface IBrowserWorkbenchEnviro
  	readonly isEnabledFileUploads?: boolean;
  
  	/**
@@ -163,7 +163,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
  	 * Gets whether a resolver extension is expected for the environment.
  	 */
  	readonly expectsResolverExtension: boolean;
-@@ -135,6 +140,13 @@ export class BrowserWorkbenchEnvironment
+@@ -140,6 +145,13 @@ export class BrowserWorkbenchEnvironment
  		return this.options.isEnabledFileUploads;
  	}
  
@@ -181,7 +181,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -21,6 +21,7 @@ export const serverOptions: OptionDescri
+@@ -37,6 +37,7 @@ export const serverOptions: OptionDescri
  	'auth': { type: 'string' },
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
@@ -189,7 +189,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
+@@ -134,6 +135,7 @@ export interface ServerParsedArgs {
  	'auth'?: string;
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
@@ -201,7 +201,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -384,6 +384,7 @@ export class WebClientServer {
+@@ -429,6 +429,7 @@ export class WebClientServer {
  			userDataPath: this._environmentService.userDataPath,
  			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
  			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],
@@ -216,13 +216,13 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 @@ -6,7 +6,7 @@
  import { Disposable } from '../../base/common/lifecycle.js';
  import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
- import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
+ import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext, IsChromeOSContext } from '../../platform/contextkey/common/contextkeys.js';
 -import { IsEnabledFileDownloads, IsEnabledFileUploads, SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SecondarySideBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext } from '../common/contextkeys.js';
 +import { IsEnabledFileDownloads, IsEnabledFileUploads, IsEnabledCoderGettingStarted, SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SecondarySideBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext } from '../common/contextkeys.js';
  import { preferredSideBySideGroupDirection, GroupDirection, IEditorGroupsService } from '../services/editor/common/editorGroupsService.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
  import { IBrowserWorkbenchEnvironmentService } from '../services/environment/browser/environmentService.js';
-@@ -208,6 +208,7 @@ export class WorkbenchContextKeysHandler
+@@ -209,6 +209,7 @@ export class WorkbenchContextKeysHandler
  		// code-server
  		IsEnabledFileDownloads.bindTo(this.contextKeyService).set(this.environmentService.isEnabledFileDownloads ?? true)
  		IsEnabledFileUploads.bindTo(this.contextKeyService).set(this.environmentService.isEnabledFileUploads ?? true)

patches/integration.diff

@@ -19,22 +19,21 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
  import { parseArgs, ErrorReporter } from '../../platform/environment/node/argv.js';
  import { join, dirname } from '../../base/common/path.js';
  import { performance } from 'perf_hooks';
--import { serverOptions } from './serverEnvironmentService.js';
-+import { serverOptions, ServerParsedArgs } from './serverEnvironmentService.js';
+-import { agentHostBridgeConnectionTokenEnvironmentVariable, serverOptions } from './serverEnvironmentService.js';
++import { agentHostBridgeConnectionTokenEnvironmentVariable, serverOptions, ServerParsedArgs } from './serverEnvironmentService.js';
  import product from '../../platform/product/common/product.js';
  import * as perf from '../../base/common/performance.js';
  
-@@ -34,38 +34,47 @@ const errorReporter: ErrorReporter = {
+@@ -34,40 +34,49 @@ const errorReporter: ErrorReporter = {
  	}
  };
  
 -const args = parseArgs(process.argv.slice(2), serverOptions, errorReporter);
-+function parse(): ServerParsedArgs {
-+	return parseArgs(process.argv.slice(2), serverOptions, errorReporter);
-+}
- 
+-const agentHostBridgeConnectionToken = process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
+-delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
+-
 -const REMOTE_DATA_FOLDER = args['server-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
--const USER_DATA_PATH = join(REMOTE_DATA_FOLDER, 'data');
+-const USER_DATA_PATH = args['user-data-dir'] || join(REMOTE_DATA_FOLDER, 'data');
 -const APP_SETTINGS_HOME = join(USER_DATA_PATH, 'User');
 -const GLOBAL_STORAGE_HOME = join(APP_SETTINGS_HOME, 'globalStorage');
 -const LOCAL_HISTORY_HOME = join(APP_SETTINGS_HOME, 'History');
@@ -52,6 +51,10 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 -		}
 -	} catch (err) { console.error(err); }
 -});
++function parse(): ServerParsedArgs {
++	return parseArgs(process.argv.slice(2), serverOptions, errorReporter);
++}
++
 +function createDirs(args: ServerParsedArgs): string {
 +	const REMOTE_DATA_FOLDER = args['server-data-dir'] || args['user-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
 +	const USER_DATA_PATH = args['user-data-dir'] || join(REMOTE_DATA_FOLDER, 'data');
@@ -80,7 +83,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
   */
 -export function spawnCli() {
 -	runCli(args, REMOTE_DATA_FOLDER, serverOptions);
-+function spawnCli(args = parse()): Promise<void> {
++function spawnCli(args = parse()) {
 +	return runCli(args, createDirs(args), serverOptions);
  }
  
@@ -88,9 +91,11 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
   * invoked by server-main.js
   */
 -export function createServer(address: string | net.AddressInfo | null): Promise<IServerAPI> {
--	return doCreateServer(address, args, REMOTE_DATA_FOLDER);
+-	return doCreateServer(address, args, REMOTE_DATA_FOLDER, agentHostBridgeConnectionToken);
 +function createServer(address: string | net.AddressInfo | null, args = parse()): Promise<IServerAPI> {
-+	return doCreateServer(address, args, createDirs(args));
++	const agentHostBridgeConnectionToken = process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
++	delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
++	return doCreateServer(address, args, createDirs(args), agentHostBridgeConnectionToken);
  }
 +
 +// The aliases prevent the names getting mangled during minification which would
@@ -209,8 +214,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -26,8 +27,9 @@
- 		<meta id="vscode-workbench-builtin-extensions" data-settings="{{WORKBENCH_BUILTIN_EXTENSIONS}}">
+@@ -28,8 +29,9 @@
+ 		<meta id="vscode-workbench-css-modules" data-settings="{{WORKBENCH_DEV_CSS_MODULES}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
 -		<link rel="icon" href="{{WORKBENCH_WEB_BASE_URL}}/resources/server/favicon.ico" type="image/x-icon" />
@@ -220,7 +225,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
 +		<link rel="manifest" href="/manifest.json" crossorigin="use-credentials" />
  		<style id="vscode-css-modules" type="text/css" media="screen"></style>
  
- 	</head>
+ 		<!-- Startup fallback: shown only if the scripts below never run, e.g. because a proxy,
 Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.html
@@ -235,7 +240,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -23,8 +24,9 @@
+@@ -24,8 +25,9 @@
  		<meta id="vscode-workbench-auth-session" data-settings="{{WORKBENCH_AUTH_SESSION}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
@@ -246,12 +251,12 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 +		<link rel="manifest" href="/manifest.json" crossorigin="use-credentials" />
  		<link rel="stylesheet" href="{{WORKBENCH_WEB_BASE_URL}}/out/vs/code/browser/workbench/workbench.css">
  
- 	</head>
+ 		<!-- Startup fallback: shown only if the scripts below never run, e.g. because a proxy,
 Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -349,6 +349,7 @@ export class WebClientServer {
+@@ -394,6 +394,7 @@ export class WebClientServer {
  		} : undefined;
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {

patches/local-storage.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -375,6 +375,7 @@ export class WebClientServer {
+@@ -420,6 +420,7 @@ export class WebClientServer {
  			remoteAuthority,
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
@@ -46,7 +46,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -102,7 +102,14 @@ export class BrowserWorkbenchEnvironment
+@@ -107,7 +107,14 @@ export class BrowserWorkbenchEnvironment
  	get logFile(): URI { return joinPath(this.windowLogsPath, 'window.log'); }
  
  	@memoize
@@ -66,7 +66,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
-@@ -148,8 +148,10 @@ export class WorkspaceService extends Di
+@@ -150,8 +150,10 @@ export class WorkspaceService extends Di
  		this.workspaceConfiguration = this._register(new WorkspaceConfiguration(configurationCache, fileService, uriIdentityService, logService));
  		this._register(this.workspaceConfiguration.onDidUpdateConfiguration(fromCache => {
  			this.onWorkspaceConfigurationChanged(fromCache).then(() => {
@@ -79,7 +79,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
  			});
  		}));
  
-@@ -561,6 +563,12 @@ export class WorkspaceService extends Di
+@@ -563,6 +565,12 @@ export class WorkspaceService extends Di
  			previousFolders = this.workspace.folders;
  			this.workspace.update(workspace);
  		} else {

patches/logout.diff

@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -18,6 +18,7 @@ import { ProtocolConstants } from '../..
+@@ -34,6 +34,7 @@ export function getRedactedServerParsedA
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -112,6 +113,7 @@ export const serverOptions: OptionDescri
+@@ -128,6 +129,7 @@ export const serverOptions: OptionDescri
  export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
@@ -40,7 +40,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -357,6 +357,7 @@ export class WebClientServer {
+@@ -402,6 +402,7 @@ export class WebClientServer {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,

patches/marketplace.diff

@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
 @@ -65,6 +65,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
- 			Object.assign(product, { copilotVersions: { runtime, sdk } });
+ 			Object.assign(product, { copilotVersions: { runtime: packageConfiguration.copilotRuntimeVersion, sdk } });
  		}
  	}
 +
@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -342,7 +342,6 @@ export class WebClientServer {
+@@ -387,7 +387,6 @@ export class WebClientServer {
  
  		const staticRoute = posix.join(basePath, this._productPath, STATIC_PATH);
  		const callbackRoute = posix.join(basePath, this._productPath, CALLBACK_PATH);
@@ -49,7 +49,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  
  		const resolveWorkspaceURI = (defaultLocation?: string) => defaultLocation && URI.file(resolve(defaultLocation)).with({ scheme: Schemas.vscodeRemote, authority: remoteAuthority });
  
-@@ -359,14 +358,7 @@ export class WebClientServer {
+@@ -404,14 +403,7 @@ export class WebClientServer {
  			rootEndpoint: rootBase,
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,

patches/proposed-api.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/common/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
-@@ -324,6 +324,10 @@ function extensionDescriptionArrayToMap(
+@@ -321,6 +321,10 @@ function extensionDescriptionArrayToMap(
  }
  
  export function isProposedApiEnabled(extension: IExtensionDescription, proposal: ApiProposalName): boolean {

patches/proxy-uri.diff

@@ -13,12 +13,18 @@ This has e2e tests.
 For the `asExternalUri` changes, you'll need to test manually by:
 1. running code-server with the test extension
 2. Command Palette > code-server: asExternalUri test
-3. input a url like http://localhost:3000
-4. it should show a notification and show output as <code-server>/proxy/3000
+3. input a url like http://localhost:3000/my/path?token=abc#section
+4. it should show a notification and show output as
+   <code-server>/proxy/3000/my/path?token%3Dabc#section
 
 Do the same thing but set `VSCODE_PROXY_URI: "https://{{port}}-main-workspace-name-user-name.coder.com"`
 and the output should replace `{{port}}` with port used in input url.
 
+The rewritten URI must preserve the original path, query, and fragment (see
+#7668). Append the original path to the proxy path using URI components so
+encoded characters are not decoded or encoded twice. This also works with
+proxy templates that do not have a trailing slash.
+
 This also enables the forwared ports view panel by default.
 
 Lastly, it adds a tunnelProvider so that ports are forwarded using code-server's
@@ -71,7 +77,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -358,6 +358,7 @@ export class WebClientServer {
+@@ -403,6 +403,7 @@ export class WebClientServer {
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
@@ -104,7 +110,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
  import type { IURLCallbackProvider } from '../../../workbench/services/url/browser/urlService.js';
  import { create } from '../../../workbench/workbench.web.main.internal.js';
  
-@@ -612,6 +613,39 @@ class WorkspaceProvider implements IWork
+@@ -616,6 +617,44 @@ class WorkspaceProvider implements IWork
  		settingsSyncOptions: config.settingsSyncOptions ? { enabled: config.settingsSyncOptions.enabled, } : undefined,
  		workspaceProvider: WorkspaceProvider.create(config),
  		urlCallbackProvider: new LocalStorageURLCallbackProvider(config.callbackRoute),
@@ -116,7 +122,12 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 +					const renderedTemplate = config.productConfiguration.proxyEndpointTemplate
 +						.replace('{{port}}', localhostMatch.port.toString())
 +						.replace('{{host}}', window.location.host)
-+					resolvedUri = URI.parse(new URL(renderedTemplate, window.location.href).toString())
++					const proxyUri = URI.parse(new URL(renderedTemplate, window.location.href).toString())
++					resolvedUri = proxyUri.with({
++						path: proxyUri.path.replace(/\/$/, '') + uri.path,
++						query: uri.query,
++						fragment: uri.fragment,
++					})
 +				} else {
 +					throw new Error(`Failed to resolve external URI: ${uri.toString()}. Could not determine base url because productConfiguration missing.`)
 +				}
@@ -148,7 +159,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExpl
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
-@@ -99,8 +99,8 @@ export class ForwardedPortsView extends
+@@ -100,8 +100,8 @@ export class ForwardedPortsView extends
  	private async enableForwardedPortsFeatures() {
  		this.contextKeyListener.clear();
  

patches/remote-secret-storage.diff

@@ -0,0 +1,90 @@
+AI: store secrets on remote for VS Code Web
+Index: code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/platform/secrets/common/secrets.ts
++++ code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
+@@ -144,8 +144,13 @@ export class BaseSecretStorageService ex
+ 				return await readEncryptedSecret(
+ 					key,
+ 					(fullKey) => this.getValueFromStorage(key, fullKey, storageService),
+-					// If the storage service is in-memory, we don't need to decrypt
+-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.decrypt(v),
++					// Don't decrypt if storage is in-memory or if encryption service is not available
++					async (v) => {
++						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
++							return v;
++						}
++						return this._encryptionService.decrypt(v);
++					},
+ 					this._logService,
+ 				);
+ 			} catch (e) {
+@@ -168,8 +173,13 @@ export class BaseSecretStorageService ex
+ 					key,
+ 					value,
+ 					(fullKey, encrypted) => this.setValueInStorage(key, fullKey, encrypted, storageService),
+-					// If the storage service is in-memory, we don't need to encrypt
+-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.encrypt(v),
++					// Don't encrypt if storage is in-memory or if encryption service is not available
++					async (v) => {
++						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
++							return v;
++						}
++						return this._encryptionService.encrypt(v);
++					},
+ 					this._logService,
+ 				);
+ 			} catch (e) {
+@@ -224,8 +234,9 @@ export class BaseSecretStorageService ex
+ 
+ 	private async initialize(): Promise<IStorageService> {
+ 		let storageService;
+-		if (!this._useInMemoryStorage && await this._encryptionService.isEncryptionAvailable()) {
+-			this._logService.trace(`[SecretStorageService] Encryption is available, using persisted storage`);
++		if (!this._useInMemoryStorage) {
++			// Use persisted storage when not forced to use in-memory
++			this._logService.trace(`[SecretStorageService] Using persisted storage`);
+ 			this._type = 'persisted';
+ 			storageService = this._storageService;
+ 		} else {
+@@ -233,7 +244,7 @@ export class BaseSecretStorageService ex
+ 			if (this._type === 'in-memory') {
+ 				return this._storageService;
+ 			}
+-			this._logService.trace('[SecretStorageService] Encryption is not available, falling back to in-memory storage');
++			this._logService.trace('[SecretStorageService] Falling back to in-memory storage');
+ 			this._type = 'in-memory';
+ 			storageService = this._register(new InMemoryStorageService());
+ 		}
+Index: code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
++++ code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
+@@ -22,9 +22,9 @@ export class BrowserSecretStorageService
+ 		@IBrowserWorkbenchEnvironmentService environmentService: IBrowserWorkbenchEnvironmentService,
+ 		@ILogService logService: ILogService
+ 	) {
+-		// We don't have encryption in the browser so instead we use the
+-		// in-memory base class implementation instead.
+-		super(true, storageService, encryptionService, logService);
++		// Use remote storage if enabled, otherwise use in-memory storage
++		const useRemoteStorage = environmentService.options?.remoteStorageEnabled ?? false;
++		super(!useRemoteStorage, storageService, encryptionService, logService);
+ 
+ 		if (environmentService.options?.secretStorageProvider) {
+ 			this._secretStorageProvider = environmentService.options.secretStorageProvider;
+Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
++++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
+@@ -655,8 +655,8 @@ class WorkspaceProvider implements IWork
+ 				})
+ 			}
+ 		},
+-		secretStorageProvider: config.remoteAuthority && !secretStorageKeyPath
+-			? undefined /* with a remote without embedder-preferred storage, store on the remote */
++		secretStorageProvider: config.remoteStorageEnabled || (config.remoteAuthority && !secretStorageKeyPath)
++			? undefined /* with remote storage enabled, or without embedder-prefered storage, store on the remote */
+ 			: new LocalStorageSecretStorageProvider(secretStorageCrypto),
+ 	});
+ })();

patches/remote-storage.diff

@@ -0,0 +1,246 @@
+Reuse VS Code's Electron storage service for remote persistence
+
+Index: code-server/lib/vscode/src/vs/platform/storage/electron-main/storageMainService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/platform/storage/electron-main/storageMainService.ts
++++ code-server/lib/vscode/src/vs/platform/storage/electron-main/storageMainService.ts
+@@ -11,7 +11,12 @@ import { IStorage } from '../../../base/
+ import { INativeEnvironmentService } from '../../environment/common/environment.js';
+ import { IFileService } from '../../files/common/files.js';
+ import { createDecorator } from '../../instantiation/common/instantiation.js';
+-import { ILifecycleMainService, LifecycleMainPhase, ShutdownReason } from '../../lifecycle/electron-main/lifecycleMainService.js';
++import type { ILifecycleMainService, ShutdownReason } from '../../lifecycle/electron-main/lifecycleMainService.js';
++
++// Keep these values local so the server does not load lifecycleMainService at runtime;
++// that module imports Electron, which is not present in the code-server server image.
++const LIFECYCLE_MAIN_PHASE_AFTER_WINDOW_OPEN = 3;
++const SHUTDOWN_REASON_KILL = 2;
+ import { ILogService } from '../../log/common/log.js';
+ import { AbstractStorageService, isProfileUsingDefaultStorage, IStorageService, StorageScope, StorageTarget } from '../common/storage.js';
+ import { ApplicationStorageMain, ApplicationSharedStorageMain, ProfileStorageMain, InMemoryStorageMain, IStorageMain, IStorageMainOptions, WorkspaceStorageMain, IStorageChangeEvent } from './storageMain.js';
+@@ -92,7 +97,7 @@ export class StorageMainService extends
+ 		@ILogService private readonly logService: ILogService,
+ 		@INativeEnvironmentService private readonly environmentService: INativeEnvironmentService,
+ 		@IUserDataProfilesMainService private readonly userDataProfilesService: IUserDataProfilesMainService,
+-		@ILifecycleMainService private readonly lifecycleMainService: ILifecycleMainService,
++		private readonly lifecycleMainService: ILifecycleMainService,
+ 		@IFileService private readonly fileService: IFileService,
+ 		@IUriIdentityService private readonly uriIdentityService: IUriIdentityService,
+ 	) {
+@@ -114,7 +119,7 @@ export class StorageMainService extends
+ 
+ 		// Application Storage: Warmup when any window opens
+ 		(async () => {
+-			await this.lifecycleMainService.when(LifecycleMainPhase.AfterWindowOpen);
++			await this.lifecycleMainService.when(LIFECYCLE_MAIN_PHASE_AFTER_WINDOW_OPEN);
+ 
+ 			this.applicationStorage.init();
+ 			this.applicationSharedStorage.init();
+@@ -253,7 +258,7 @@ export class StorageMainService extends
+ 	}
+ 
+ 	private createProfileStorage(profile: IUserDataProfile): IStorageMain {
+-		if (this.shutdownReason === ShutdownReason.KILL) {
++		if (this.shutdownReason === SHUTDOWN_REASON_KILL) {
+ 
+ 			// Workaround for native crashes that we see when
+ 			// SQLite DBs are being created even after shutdown
+@@ -292,7 +297,7 @@ export class StorageMainService extends
+ 	}
+ 
+ 	private createWorkspaceStorage(workspace: IAnyWorkspaceIdentifier): IStorageMain {
+-		if (this.shutdownReason === ShutdownReason.KILL) {
++		if (this.shutdownReason === SHUTDOWN_REASON_KILL) {
+ 
+ 			// Workaround for native crashes that we see when
+ 			// SQLite DBs are being created even after shutdown
+Index: code-server/lib/vscode/src/vs/workbench/services/storage/electron-browser/storageService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/services/storage/electron-browser/storageService.ts
++++ code-server/lib/vscode/src/vs/workbench/services/storage/electron-browser/storageService.ts
+@@ -3,7 +3,7 @@
+  *  Licensed under the MIT License. See License.txt in the project root for license information.
+  *--------------------------------------------------------------------------------------------*/
+ 
+-import { IMainProcessService } from '../../../../platform/ipc/common/mainProcessService.js';
++import { IRemoteService } from '../../../../platform/ipc/common/services.js';
+ import { IStorage, Storage, MigratingStorage } from '../../../../base/parts/storage/common/storage.js';
+ import { RemoteStorageService } from '../../../../platform/storage/common/storageService.js';
+ import { FallbackApplicationStorageDatabaseClient, ApplicationSharedStorageDatabaseClient } from '../../../../platform/storage/common/storageIpc.js';
+@@ -19,10 +19,10 @@ export class NativeWorkbenchStorageServi
+ 		workspace: IAnyWorkspaceIdentifier | undefined,
+ 		private readonly userDataProfileService: IUserDataProfileService,
+ 		userDataProfilesService: IUserDataProfilesService,
+-		mainProcessService: IMainProcessService,
++		remoteService: Pick<IRemoteService, 'getChannel'>,
+ 		private readonly workbenchEnvironmentService: IWorkbenchEnvironmentService,
+ 	) {
+-		super(workspace, { currentProfile: userDataProfileService.currentProfile, defaultProfile: userDataProfilesService.defaultProfile }, mainProcessService, workbenchEnvironmentService);
++		super(workspace, { currentProfile: userDataProfileService.currentProfile, defaultProfile: userDataProfilesService.defaultProfile }, remoteService as IRemoteService, workbenchEnvironmentService);
+ 
+ 		this.registerListeners();
+ 	}
+Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
++++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
+@@ -66,6 +66,7 @@ export const serverOptions: OptionDescri
+ 	'disable-experiments': OPTIONS['disable-experiments'],
+ 	'disable-workspace-trust': OPTIONS['disable-workspace-trust'],
+ 	'file-watcher-polling': { type: 'string', deprecates: ['fileWatcherPolling'] },
++	'enable-remote-storage': { type: 'boolean', cat: 'o', description: nls.localize('enable-remote-storage', 'Persist browser storage (settings, state, etc.) on the server instead of browser IndexedDB. Enables state portability across browsers/devices.') },
+ 	'log': OPTIONS['log'],
+ 	'logsPath': OPTIONS['logsPath'],
+ 	'force-disable-user-env': OPTIONS['force-disable-user-env'],
+@@ -212,6 +213,7 @@ export interface ServerParsedArgs {
+ 	'logsPath'?: string;
+ 
+ 	'force-disable-user-env'?: boolean;
++	'enable-remote-storage'?: boolean;
+ 	'enable-proposed-api'?: string[];
+ 
+ 	/* ----- vs code web options ----- */
+Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
++++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
+@@ -106,6 +106,10 @@ import { McpManagementChannel } from '..
+ import { AllowedMcpServersService } from '../../platform/mcp/common/allowedMcpServersService.js';
+ import { IMcpGalleryManifestService } from '../../platform/mcp/common/mcpGalleryManifest.js';
+ import { McpGalleryManifestIPCService } from '../../platform/mcp/common/mcpGalleryManifestServiceIpc.js';
++import { StorageDatabaseChannel } from '../../platform/storage/electron-main/storageIpc.js';
++import { StorageMainService } from '../../platform/storage/electron-main/storageMainService.js';
++import type { ILifecycleMainService } from '../../platform/lifecycle/electron-main/lifecycleMainService.js';
++import type { IUserDataProfilesMainService } from '../../platform/userDataProfile/electron-main/userDataProfile.js';
+ import { SANDBOX_HELPER_CHANNEL_NAME, SandboxHelperChannel } from '../../platform/sandbox/common/sandboxHelperIpc.js';
+ import { SandboxHelperService } from '../../platform/sandbox/node/sandboxHelper.js';
+ 
+@@ -244,6 +248,21 @@ export async function setupServerService
+ 	services.set(IMcpGatewayService, new SyncDescriptor(McpGatewayService));
+ 
+ 	const instantiationService: IInstantiationService = new InstantiationService(services);
++	// Reuse the Electron storage service on the remote. The server has no
++	// windows, so its lifecycle is always ready and never loads a window.
++	const storageMainService = disposables.add(new StorageMainService(
++		logService,
++		environmentService,
++		userDataProfilesService as unknown as IUserDataProfilesMainService,
++		{
++			when: () => Promise.resolve(),
++			onWillLoadWindow: Event.None,
++			onWillShutdown: Event.None,
++		} as unknown as ILifecycleMainService,
++		fileService,
++		uriIdentityService,
++	));
++
+ 	services.set(ILanguagePackService, instantiationService.createInstance(NativeLanguagePackService));
+ 
+ 	const ptyHostStarter = instantiationService.createInstance(
+@@ -446,6 +465,7 @@ export async function setupServerService
+ 
+ 		const languagePackChannel = ProxyChannel.fromService<RemoteAgentConnectionContext>(accessor.get(ILanguagePackService), disposables);
+ 		socketServer.registerChannel('languagePacks', languagePackChannel);
++		socketServer.registerChannel('storage', disposables.add(new StorageDatabaseChannel(logService, storageMainService)));
+ 
+ 		// clean up extensions folder
+ 		remoteExtensionsScanner.whenExtensionsReady().then(() => extensionManagementService.cleanUp());
+Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
++++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+@@ -451,7 +451,8 @@ export class WebClientServer {
+ 			folderUri: resolveWorkspaceURI(this._environmentService.args['default-folder']),
+ 			workspaceUri: resolveWorkspaceURI(this._environmentService.args['default-workspace']),
+ 			productConfiguration,
+-			callbackRoute: callbackRoute
++			callbackRoute: callbackRoute,
++			remoteStorageEnabled: this._environmentService.args['enable-remote-storage'] ? true : undefined
+ 		};
+ 
+ 		const cookies = cookie.parse(req.headers.cookie || '');
+Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
++++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
+@@ -411,6 +411,11 @@ export interface IWorkbenchConstructionO
+ 	readonly authenticationProviders?: readonly IAuthenticationProvider[];
+ 
+ 	//#endregion
++	/**
++	 * Persist workbench storage on the remote server instead of browser IndexedDB.
++	 */
++	readonly remoteStorageEnabled?: boolean;
++
+ 
+ 	//#region Development options
+ 
+Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
++++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
+@@ -33,6 +33,7 @@ import { ISignService } from '../../plat
+ import { SignService } from '../../platform/sign/browser/signService.js';
+ import { IWorkbenchConstructionOptions, IWorkbench, IWorkspace, ITunnel } from './web.api.js';
+ import { BrowserStorageService } from '../services/storage/browser/storageService.js';
++import { NativeWorkbenchStorageService } from '../services/storage/electron-browser/storageService.js';
+ import { IStorageService } from '../../platform/storage/common/storage.js';
+ import { toLocalISOString } from '../../base/common/date.js';
+ import { isWorkspaceToOpen, isFolderToOpen } from '../../platform/window/common/window.js';
+@@ -482,7 +483,7 @@ export class BrowserMain extends Disposa
+ 				serviceCollection.set(IWorkbenchConfigurationService, service);
+ 				return service;
+ 			}),
+-			this.createStorageService(workspace, logService, userDataProfileService).then(service => {
++			this.createStorageService(workspace, environmentService, logService, userDataProfileService, userDataProfilesService, remoteAgentService).then(service => {
+ 				serviceCollection.set(IStorageService, service);
+ 				return service;
+ 			})
+@@ -604,7 +605,21 @@ export class BrowserMain extends Disposa
+ 		}));
+ 	}
+ 
+-	protected async createStorageService(workspace: IAnyWorkspaceIdentifier, logService: ILogService, userDataProfileService: IUserDataProfileService): Promise<IStorageService> {
++	protected async createStorageService(workspace: IAnyWorkspaceIdentifier, environmentService: IBrowserWorkbenchEnvironmentService, logService: ILogService, userDataProfileService: IUserDataProfileService, userDataProfilesService: IUserDataProfilesService, remoteAgentService: IRemoteAgentService): Promise<IStorageService> {
++		const connection = remoteAgentService.getConnection();
++		if (this.configuration.remoteStorageEnabled && connection) {
++			const storageService = new NativeWorkbenchStorageService(workspace, userDataProfileService, userDataProfilesService, connection, environmentService);
++
++			try {
++				await storageService.initialize();
++				this.onWillShutdownDisposables.add(toDisposable(() => storageService.close()));
++				return storageService;
++			} catch (error) {
++				onUnexpectedError(error);
++				logService.error('Remote storage service initialization failed, falling back to browser storage', error);
++			}
++		}
++
+ 		const storageService = new BrowserStorageService(workspace, userDataProfileService, logService);
+ 
+ 		try {
+Index: code-server/lib/vscode/src/vs/sessions/browser/web.main.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/sessions/browser/web.main.ts
++++ code-server/lib/vscode/src/vs/sessions/browser/web.main.ts
+@@ -39,9 +39,9 @@ export class SessionsBrowserMain extends
+ 		_workspace: IAnyWorkspaceIdentifier,
+ 		environmentService: IBrowserWorkbenchEnvironmentService,
+ 		userDataProfileService: IUserDataProfileService,
+-		_userDataProfilesService: BrowserUserDataProfilesService,
++		userDataProfilesService: BrowserUserDataProfilesService,
+ 		fileService: FileService,
+-		_remoteAgentService: IRemoteAgentService,
++		remoteAgentService: IRemoteAgentService,
+ 		uriIdentityService: IUriIdentityService,
+ 		policyService: IPolicyService,
+ 		logService: ILogService,
+@@ -82,7 +82,7 @@ export class SessionsBrowserMain extends
+ 		serviceCollection.set(IWorkbenchConfigurationService, configurationService);
+ 
+ 		// Storage
+-		const storageService = await this.createStorageService(workspaceIdentifier, logService, userDataProfileService);
++		const storageService = await this.createStorageService(workspaceIdentifier, environmentService, logService, userDataProfileService, userDataProfilesService, remoteAgentService);
+ 		serviceCollection.set(IStorageService, storageService);
+ 
+ 		// Workspace Trust Service

patches/series

@@ -24,4 +24,6 @@ trusted-domains.diff
 signature-verification.diff
 copilot.diff
 app-name.diff
+remote-storage.diff
+remote-secret-storage.diff
 csp-hashes.diff

patches/service-worker.diff

@@ -54,7 +54,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -359,6 +359,10 @@ export class WebClientServer {
+@@ -404,6 +404,10 @@ export class WebClientServer {
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
  			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? rootBase + '/proxy/{{port}}/',

patches/sourcemaps.diff

@@ -6,7 +6,7 @@ Index: code-server/lib/vscode/build/gulpfile.reh.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.reh.ts
 +++ code-server/lib/vscode/build/gulpfile.reh.ts
-@@ -344,10 +344,15 @@ function packageTask(type: string, platf
+@@ -260,10 +260,15 @@ function packageTask(type: string, platf
  	const destination = path.join(BUILD_ROOT, destinationFolderName);
  
  	return () => {

patches/store-socket.diff

@@ -31,7 +31,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostExtensionService.
  import { ExtHostDiskFileSystemProvider } from './extHostDiskFileSystemProvider.js';
  import nodeModule from 'node:module';
  import { assertType } from '../../../base/common/types.js';
-@@ -175,6 +177,52 @@ export class ExtHostExtensionService ext
+@@ -176,6 +178,52 @@ export class ExtHostExtensionService ext
  
  		performance.mark('code/extHost/didInitAPI');
  

patches/telemetry.diff

@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { NullPolicyService } from '../../platform/policy/common/policy.js';
  import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
  import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -179,11 +180,23 @@ export async function setupServerService
+@@ -184,11 +185,23 @@ export async function setupServerService
  	const requestService = new RequestService('remote', configurationService, environmentService, logService);
  	services.set(IRequestService, requestService);
  
@@ -126,7 +126,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -363,6 +363,8 @@ export class WebClientServer {
+@@ -408,6 +408,8 @@ export class WebClientServer {
  				scope: vscodeBase + '/',
  				path: rootBase + '/_static/out/browser/serviceWorker.js',
  			},

patches/trusted-domains.diff

@@ -4,7 +4,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -23,6 +23,7 @@ export const serverOptions: OptionDescri
+@@ -39,6 +39,7 @@ export const serverOptions: OptionDescri
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -122,6 +123,7 @@ export interface ServerParsedArgs {
+@@ -138,6 +139,7 @@ export interface ServerParsedArgs {
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
@@ -24,7 +24,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -354,6 +354,14 @@ export class WebClientServer {
+@@ -399,6 +399,14 @@ export class WebClientServer {
  			scopes: [['user:email'], ['repo']]
  		} : undefined;
  
@@ -39,7 +39,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
-@@ -369,6 +377,7 @@ export class WebClientServer {
+@@ -414,6 +422,7 @@ export class WebClientServer {
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,
  			extensionsGallery: this._productService.extensionsGallery,

patches/unique-db.diff

@@ -21,7 +21,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/storage/browser/storageS
  
  export class BrowserStorageService extends AbstractStorageService {
  
-@@ -354,7 +355,11 @@ export class IndexedDBStorageDatabase ex
+@@ -365,7 +366,11 @@ export class IndexedDBStorageDatabase ex
  	}
  
  	static async createWorkspaceStorage(workspaceId: string, logService: ILogService): Promise<IIndexedDBStorageDatabase> {

patches/update-check.diff

@@ -101,19 +101,19 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
  
  	readonly version: string;
  	readonly date?: string;
-@@ -151,6 +152,7 @@ export interface IProductConfiguration {
- 		readonly resourceUrlTemplate: string;
- 		readonly nlsBaseUrl: string;
- 		readonly accessSKUs?: string[];
-+		readonly authorizationHeaderToken?: string;
+@@ -148,6 +149,7 @@ export interface IProductConfiguration {
  	};
  
- 	readonly agentSdks?: { readonly [packageId: string]: IAgentSdkProductConfig };
+ 	readonly extensionsGallery?: {
++		readonly authorizationHeaderToken?: string;
+ 		readonly serviceUrl: string;
+ 		readonly controlUrl: string;
+ 		readonly extensionUrlTemplate: string;
 Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -356,6 +356,7 @@ export class WebClientServer {
+@@ -401,6 +401,7 @@ export class WebClientServer {
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
@@ -125,8 +125,8 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -16,6 +16,8 @@ import { join } from '../../base/common/
- import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
+@@ -32,6 +32,8 @@ export function getRedactedServerParsedA
+ }
  
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
 +	/* ----- code-server ----- */
@@ -134,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -108,6 +110,8 @@ export const serverOptions: OptionDescri
+@@ -124,6 +126,8 @@ export const serverOptions: OptionDescri
  };
  
  export interface ServerParsedArgs {

patches/webview.diff

@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -234,7 +234,7 @@ export class BrowserWorkbenchEnvironment
+@@ -239,7 +239,7 @@ export class BrowserWorkbenchEnvironment
  
  	@memoize
  	get webviewExternalEndpoint(): string {
@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -371,6 +371,7 @@ export class WebClientServer {
+@@ -416,6 +416,7 @@ export class WebClientServer {
  		const workbenchWebConfiguration = {
  			remoteAuthority,
  			serverBasePath: basePath,
@@ -53,7 +53,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
 +++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
-@@ -253,7 +253,7 @@
+@@ -266,7 +266,7 @@
  			}
  
  			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}&platform=${searchParams.get('platform')}`);
@@ -62,7 +62,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  				.then(async registration => {
  					if (navigator.serviceWorker.controller) {
  						// A previous SW is already controlling. Force an update
-@@ -332,6 +332,12 @@
+@@ -345,6 +345,12 @@
  
  				const hostname = location.hostname;
  

src/node/cli.ts

@@ -1,8 +1,9 @@
 import { field, Level, logger } from "@coder/logger"
+import * as crypto from "crypto"
 import { promises as fs } from "fs"
 import { load } from "js-yaml"
 import * as path from "path"
-import { generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
+import { expandTilde, generateCertificate, generatePassword, paths, splitOnFirstEquals } from "./util"
 import { EditorSessionManagerClient } from "./vscodeSocket"
 
 export enum Feature {
@@ -46,6 +47,7 @@ export interface UserProvidedCodeArgs {
   "show-versions"?: boolean
   category?: string
   "github-auth"?: string
+  "enable-remote-storage"?: boolean
   "disable-update-check"?: boolean
   "disable-file-downloads"?: boolean
   "disable-file-uploads"?: boolean
@@ -274,6 +276,10 @@ export const options: Options<Required<UserProvidedArgs>> = {
     type: "string",
     description: "GitHub authentication token (can only be passed in via $GITHUB_TOKEN or the config file).",
   },
+  "enable-remote-storage": {
+    type: "boolean",
+    description: "Persist VS Code workbench storage on the remote server instead of browser storage.",
+  },
   "proxy-domain": { type: "string[]", description: "Domain used for proxying ports." },
   "skip-auth-preflight": {
     type: "boolean",
@@ -428,13 +434,13 @@ export const parse = (
         throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
       }
 
-      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
-        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
-      }
-
       const option = options[key]
       if (option.type === "boolean") {
-        ;(args[key] as boolean) = true
+        // Booleans set to false (for example `--flag=false`, which is also how
+        // false values from the config file are passed in) are ignored.
+        if (value !== "false") {
+          ;(args[key] as boolean) = true
+        }
         continue
       }
 
@@ -451,12 +457,16 @@ export const parse = (
         throw error(`--${key} requires a value`)
       }
 
+      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
+        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
+      }
+
       if (option.type === OptionalString && value === "false") {
         continue
       }
 
       if (option.path) {
-        value = path.resolve(value)
+        value = path.resolve(expandTilde(value))
       }
 
       switch (option.type) {
@@ -561,7 +571,7 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
   }
 
   if (!args["session-socket"]) {
-    args["session-socket"] = path.join(args["user-data-dir"], "code-server-ipc.sock")
+    args["session-socket"] = defaultSessionSocket(args["user-data-dir"])
   }
   process.env.CODE_SERVER_SESSION_SOCKET = args["session-socket"]
 
@@ -710,6 +720,25 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
   } as DefaultedArgs // TODO: Technically no guarantee this is fulfilled.
 }
 
+/**
+ * The session socket to use when one was not given.
+ *
+ * Windows has no Unix sockets, so there it is a named pipe, which lives in its
+ * own namespace rather than on disk and so cannot be placed inside the user
+ * data directory. The name is derived from that directory anyway, so that two
+ * instances with separate data directories do not collide and a later
+ * invocation with the same one finds the first. Windows paths are compared
+ * without regard to case, so the name is folded before it is hashed; otherwise
+ * the same directory typed two ways would produce two pipes.
+ */
+export function defaultSessionSocket(userDataDir: string, platform: NodeJS.Platform = process.platform): string {
+  if (platform !== "win32") {
+    return path.join(userDataDir, "code-server-ipc.sock")
+  }
+  const name = crypto.createHash("sha256").update(path.resolve(userDataDir).toLowerCase()).digest("hex").slice(0, 16)
+  return String.raw`\\.\pipe\code-server-ipc-${name}`
+}
+
 export function getResolvedPathsFromArgs(args: UserProvidedArgs): string[] {
   return (args._ ?? []).map((p) => path.resolve(p))
 }

src/node/i18n/index.ts

@@ -3,6 +3,7 @@ import i18next, { init } from "i18next"
 import * as en from "./locales/en.json"
 import * as ja from "./locales/ja.json"
 import * as th from "./locales/th.json"
+import * as tr from "./locales/tr.json"
 import * as ur from "./locales/ur.json"
 import * as zhCn from "./locales/zh-cn.json"
 
@@ -16,6 +17,9 @@ const defaultResources = {
   th: {
     translation: th,
   },
+  tr: {
+    translation: tr,
+  },
   ja: {
     translation: ja,
   },

src/node/i18n/locales/tr.json

@@ -0,0 +1,13 @@
+{
+  "LOGIN_TITLE": "{{app}} girişi",
+  "LOGIN_BELOW": "Lütfen aşağıdan giriş yapın.",
+  "WELCOME": "{{app}} uygulamasına hoş geldiniz",
+  "LOGIN_PASSWORD": "Parola için yapılandırma dosyasını kontrol edin.",
+  "LOGIN_USING_ENV_PASSWORD": "Parola $PASSWORD ortam değişkeninden ayarlandı.",
+  "LOGIN_USING_HASHED_PASSWORD": "Parola $HASHED_PASSWORD ortam değişkeninden ayarlandı.",
+  "SUBMIT": "GÖNDER",
+  "PASSWORD_PLACEHOLDER": "PAROLA",
+  "LOGIN_RATE_LIMIT": "Giriş denemesi sınırına ulaşıldı!",
+  "MISS_PASSWORD": "Parola eksik",
+  "INCORRECT_PASSWORD": "Parola yanlış."
+}

src/node/routes/index.ts

@@ -132,8 +132,10 @@ export const register = async (
     })
   })
 
-  app.router.use(express.json())
-  app.router.use(express.urlencoded({ extended: true }))
+  // Reject compressed request bodies so unauthenticated requests cannot reach
+  // the zlib/Brotli decoders. Browsers never compress request bodies.
+  app.router.use(express.json({ inflate: false }))
+  app.router.use(express.urlencoded({ extended: true, inflate: false }))
 
   app.router.use(
     "/_static",

src/node/util.ts

@@ -511,3 +511,18 @@ export function splitOnFirstEquals(str: string): [string, string | undefined] {
   const split = str.split(/=(.+)?/, 2)
   return [split[0], split[1]]
 }
+
+/**
+ * Expand a leading `~` to the home directory.  The shell does this for
+ * command-line arguments but values from the config file are not expanded.
+ * `~user` forms are left alone.
+ */
+export function expandTilde(p: string): string {
+  if (p === "~") {
+    return os.homedir()
+  }
+  if (p.startsWith("~/") || p.startsWith(`~${path.sep}`)) {
+    return path.join(os.homedir(), p.slice(2))
+  }
+  return p
+}

src/node/vscodeSocket.ts

@@ -38,7 +38,7 @@ export async function makeEditorSessionManagerServer(
 ): Promise<http.Server> {
   const router = express()
 
-  router.use(express.json())
+  router.use(express.json({ inflate: false }))
 
   router.get<{}, GetSessionResponse | string | unknown, undefined, { filePath?: string }>(
     "/session",

test/e2e/downloads.test.ts

@@ -32,7 +32,6 @@ describe("Downloads (enabled)", ["--disable-workspace-trust"], {}, async () => {
     await codeServerPage.page.waitForSelector(`text=${fileName}`)
 
     await codeServerPage.openFile(fileName)
-    await codeServerPage.page.click(".tab")
     await codeServerPage.navigateMenus(["File", "Auto Save"])
     await codeServerPage.page.keyboard.type("Making some edits.")
     await codeServerPage.navigateMenus(["File", "Save As..."])
@@ -85,8 +84,8 @@ describe("Downloads (disabled)", ["--disable-workspace-trust", "--disable-file-d
     // Action
     await codeServerPage.page.waitForSelector(`text=${fileName}`)
     await codeServerPage.openFile(fileName)
-    await codeServerPage.page.click(".tab")
     await codeServerPage.navigateMenus(["File", "Save As..."])
+    await codeServerPage.page.waitForSelector(".quick-input-widget")
     await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
   })
 

test/e2e/extensions.test.ts

@@ -15,6 +15,56 @@ function runTestExtensionTests() {
     const normalizedAddress = address.replace(/\/+$/, "")
     await expect(codeServerPage.page.getByText(`Info: proxyUri: ${normalizedAddress}/proxy/{{port}}/`)).toBeVisible()
   })
+
+  runExternalUriTests()
+}
+
+function runExternalUriTests(proxyEndpointTemplate?: string) {
+  const cases = [
+    {
+      name: "path",
+      input: "http://127.0.0.1:1234/my/path",
+      suffix: "/my/path",
+    },
+    {
+      name: "query and fragment",
+      input: "http://localhost:1234/my/path?token=abc&mode=preview#section",
+      suffix: "/my/path?token%3Dabc%26mode%3Dpreview#section",
+    },
+    {
+      name: "encoded components",
+      input: "http://0.0.0.0:1234/my%20path/%23file?token=a%20b#my%20section",
+      suffix: "/my%20path/%23file?token%3Da%20b#my%20section",
+    },
+    {
+      name: "root path",
+      input: "http://127.0.0.1:1234/",
+      suffix: "/",
+    },
+  ]
+
+  for (const { name, input, suffix } of cases) {
+    test(`asExternalUri should preserve ${name}`, async ({ codeServerPage }) => {
+      const address = await getMaybeProxiedCodeServer(codeServerPage)
+      const normalizedAddress = address.replace(/\/+$/, "")
+      const proxyBase = proxyEndpointTemplate
+        ? new URL(proxyEndpointTemplate.replace("{{port}}", "1234"), `${normalizedAddress}/`).toString()
+        : `${normalizedAddress}/proxy/1234/`
+
+      await codeServerPage.waitForTestExtensionLoaded()
+      await codeServerPage.executeCommandViaMenus("code-server: asExternalUri test")
+
+      await codeServerPage.page.waitForSelector(".quick-input-widget:focus-within")
+      await codeServerPage.page.keyboard.type(input)
+      await codeServerPage.page.keyboard.press("Enter")
+
+      // The test extension displays URI.toString(), which also encodes query delimiters.
+      const output = `${proxyBase.replace(/\/$/, "")}${suffix}`
+      await expect(
+        codeServerPage.page.getByText(`Info: input: ${input} output: ${output}`, { exact: true }),
+      ).toBeVisible()
+    })
+  }
 }
 
 const flags = ["--disable-workspace-trust", "--extensions-dir", path.join(__dirname, "./extensions")]
@@ -23,6 +73,17 @@ describe("Extensions", flags, {}, () => {
   runTestExtensionTests()
 })
 
+for (const proxyEndpointTemplate of ["./proxy/{{port}}", "https://{{port}}-workspace.example.com"]) {
+  describe(
+    `Extensions with VSCODE_PROXY_URI=${proxyEndpointTemplate}`,
+    flags,
+    { VSCODE_PROXY_URI: proxyEndpointTemplate },
+    () => {
+      runExternalUriTests(proxyEndpointTemplate)
+    },
+  )
+}
+
 if (process.env.USE_PROXY !== "1") {
   describe("Extensions with --cert", [...flags, "--cert"], {}, () => {
     runTestExtensionTests()

test/e2e/extensions/test-extension/extension.ts

@@ -2,7 +2,8 @@ import * as vscode from "vscode"
 
 export function activate(context: vscode.ExtensionContext) {
   vscode.window.showInformationMessage("test extension loaded")
-  // Test extension
+
+  // Prints the current proxy URI into a notification.
   context.subscriptions.push(
     vscode.commands.registerCommand("codeServerTest.proxyUri", () => {
       if (process.env.VSCODE_PROXY_URI) {
@@ -13,7 +14,8 @@ export function activate(context: vscode.ExtensionContext) {
     }),
   )
 
-  // asExternalUri extension
+  // Asks for a URI, then runs it through asExternalUri and prints the result
+  // into a notification.
   context.subscriptions.push(
     vscode.commands.registerCommand("codeServerTest.asExternalUri", async () => {
       const input = await vscode.window.showInputBox({
@@ -28,4 +30,29 @@ export function activate(context: vscode.ExtensionContext) {
       }
     }),
   )
+
+  const secretKey = "code-server-test-secret"
+
+  // Asks for a string, then stores it as a secret.
+  context.subscriptions.push(
+    vscode.commands.registerCommand("codeServerTest.setSecret", async () => {
+      const input = await vscode.window.showInputBox({
+        prompt: "Secret to store",
+      })
+
+      if (input) {
+        await context.secrets.store(secretKey, input)
+        vscode.window.showInformationMessage(`set secret: ${input}`)
+      } else {
+        vscode.window.showErrorMessage(`Failed to run test case. No input provided.`)
+      }
+    }),
+  )
+
+  // Prints the current secret, if any.
+  context.subscriptions.push(
+    vscode.commands.registerCommand("codeServerTest.getSecret", async () => {
+      vscode.window.showInformationMessage(`get secret: ${await context.secrets.get(secretKey)}`)
+    }),
+  )
 }

test/e2e/extensions/test-extension/package.json

@@ -22,6 +22,16 @@
         "command": "codeServerTest.asExternalUri",
         "title": "asExternalUri test",
         "category": "code-server"
+      },
+      {
+        "command": "codeServerTest.setSecret",
+        "title": "Set test secret",
+        "category": "code-server"
+      },
+      {
+        "command": "codeServerTest.getSecret",
+        "title": "Get test secret",
+        "category": "code-server"
       }
     ]
   },

test/e2e/models/CodeServer.ts

@@ -363,13 +363,14 @@ export class CodeServerPage {
   }
 
   /**
-   * Checks if the test extension loaded
+   * Checks if the test extension loaded by waiting for its notification.  Once
+   * it appears, dismiss the notification.
    */
   async waitForTestExtensionLoaded(): Promise<void> {
-    const selector = "text=test extension loaded"
     this.codeServer.logger.debug("Waiting for test extension to load...")
-
-    await this.page.waitForSelector(selector)
+    const locator = this.page.getByRole("dialog", { name: "Info: test extension loaded" })
+    await locator.hover()
+    await locator.getByLabel("Clear Notification (Del)").click()
   }
 
   /**
@@ -437,6 +438,7 @@ export class CodeServerPage {
   async executeCommandViaMenus(command: string) {
     await this.navigateMenus(["View", "Command Palette..."])
 
+    await this.page.waitForSelector(".quick-input-widget:focus-within")
     await this.page.keyboard.type(command)
 
     await this.page.hover(`text=${command}`)

test/e2e/settings.test.ts

@@ -0,0 +1,17 @@
+import { clean } from "../utils/helpers"
+import { describe, test, expect } from "./baseFixture"
+
+describe("settings", ["--disable-workspace-trust"], {}, () => {
+  const testName = "settings-local"
+  test.beforeAll(async () => {
+    await clean(testName)
+  })
+
+  test("should see startup editor set to none", async ({ codeServerPage }) => {
+    await codeServerPage.navigateMenus(["File", "Preferences", "Settings"])
+    await codeServerPage.page.waitForSelector(".settings-editor")
+    await codeServerPage.page.keyboard.type("startupEditor")
+    const el = codeServerPage.page.getByLabel("workbench.startupEditor")
+    await expect(el).toHaveValue("none")
+  })
+})

test/e2e/storage.test.ts

@@ -0,0 +1,61 @@
+import { promises as fs } from "fs"
+import * as path from "path"
+import { describe, test, expect } from "./baseFixture"
+
+const tests = [
+  {
+    name: "browser storage",
+    args: [],
+  },
+  {
+    name: "remote storage",
+    args: ["--enable-remote-storage"],
+  },
+]
+
+for (const tc of tests) {
+  const args = ["--disable-workspace-trust", "--extensions-dir", path.join(__dirname, "./extensions"), ...tc.args]
+  describe(tc.name, args, {}, () => {
+    test("should store workbench state and secrets", async ({ codeServerPage }) => {
+      // Create and open a file.
+      const dir = await codeServerPage.workspaceDir
+      const file = path.join(dir, "foo")
+      await fs.writeFile(file, "bar")
+      await codeServerPage.openFile(file)
+
+      // Store a secret.
+      const secret = "foo-bar-baz"
+      await codeServerPage.waitForTestExtensionLoaded()
+      await codeServerPage.executeCommandViaMenus("code-server: Set test secret")
+      await codeServerPage.page.waitForSelector(".quick-input-widget:focus-within")
+      await codeServerPage.page.keyboard.type(secret)
+      await codeServerPage.page.keyboard.press("Enter")
+      await expect(codeServerPage.page.getByText(`Info: set secret: ${secret}`)).toBeVisible()
+
+      // There should be a workspace storage directory.
+      const userDir = path.join(dir, "User/workspaceStorage")
+      const dirs = await fs.readdir(userDir)
+      expect(dirs.length).toBe(1)
+
+      const storageFile = path.join(userDir, dirs[0], "state.vscdb")
+      if (tc.args.includes("--enable-remote-storage")) {
+        // The sqlite database should exist.
+        fs.stat(storageFile)
+      } else {
+        // But no sqlite database.
+        expect(() => fs.stat(storageFile)).rejects.toThrow("ENOENT")
+      }
+
+      // Reload using a command so it has a chance to flush storage.
+      await codeServerPage.executeCommandViaMenus("Developer: Reload Window")
+      await codeServerPage.waitForTestExtensionLoaded()
+
+      // Should see the same file.
+      await codeServerPage.waitForTab(file)
+
+      // Should be able to retrieve the secret.
+      await codeServerPage.executeCommandViaMenus("code-server: Get test secret")
+      await expect(codeServerPage.page.getByText(`Info: get secret: ${secret}`)).toBeVisible()
+    })
+  })
+}

test/e2e/typescript.test.ts

@@ -0,0 +1,19 @@
+import { promises as fs } from "fs"
+import * as path from "path"
+import { describe, test, expect } from "./baseFixture"
+
+const args = ["--disable-workspace-trust"]
+
+describe("typescript extension", args, {}, () => {
+  test("should load as a workspace extension", async ({ codeServerPage }) => {
+    const dir = await codeServerPage.workspaceDir
+    const file = path.join(dir, "foo.ts")
+    await fs.writeFile(file, 'const n: number = "x"')
+    await codeServerPage.openFile(file)
+
+    await codeServerPage.executeCommandViaMenus("Developer: Show Running Extensions")
+    await expect(
+      codeServerPage.page.getByLabel("typescript-language-features").getByText(/localhost:\d+/),
+    ).toBeVisible()
+  })
+})

test/package-lock.json

@@ -23,38 +23,25 @@
         "wtfnode": "^0.9.1"
       }
     },
-    "node_modules/@ampproject/remapping": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.3.0.tgz",
-      "integrity": "sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/@babel/code-frame": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.25.7.tgz",
-      "integrity": "sha512-0xZJFNE5XMpENsgfHYTw8FbX4kv53mFLn2i3XPoq69LyhYSCBJtitaHx9QnsVTrsogI4Z3+HtEfZ2/GFPOtf5g==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/highlight": "^7.25.7",
-        "picocolors": "^1.0.0"
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.25.7.tgz",
-      "integrity": "sha512-9ickoLz+hcXCeh7jrcin+/SLWm+GkxE2kTvoYyp38p4WkdFXfQJxDFGWp/YHjiKLPx06z2A7W8XKuqbReXDzsw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -62,22 +49,22 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.25.7.tgz",
-      "integrity": "sha512-yJ474Zv3cwiSOO9nXJuqzvwEeM+chDuQ8GJirw+pZ91sCGCyOZ3dJkVE09fTV0VEVzXyLWhh3G/AolYTPX7Mow==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@ampproject/remapping": "^2.2.0",
-        "@babel/code-frame": "^7.25.7",
-        "@babel/generator": "^7.25.7",
-        "@babel/helper-compilation-targets": "^7.25.7",
-        "@babel/helper-module-transforms": "^7.25.7",
-        "@babel/helpers": "^7.25.7",
-        "@babel/parser": "^7.25.7",
-        "@babel/template": "^7.25.7",
-        "@babel/traverse": "^7.25.7",
-        "@babel/types": "^7.25.7",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
         "gensync": "^1.0.0-beta.2",
@@ -110,15 +97,16 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.25.7.tgz",
-      "integrity": "sha512-5Dqpl5fyV9pIAD62yK9P7fcA768uVPUyrQmqpqstHWgMma4feF1x/oFysBCVZLY5wJ2GkMUCdsNDnGZrPoR6rA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.25.7",
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
       },
       "engines": {
@@ -126,14 +114,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.25.7.tgz",
-      "integrity": "sha512-DniTEax0sv6isaw6qSQSfV4gVRNtw2rte8HHM45t9ZR0xILaufBRNkpMifCRiAPyvL4ACD6v0gfCwCmtOQaV4A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.25.7",
-        "@babel/helper-validator-option": "^7.25.7",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -152,31 +140,40 @@
         "semver": "bin/semver.js"
       }
     },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.25.7.tgz",
-      "integrity": "sha512-o0xCgpNmRohmnoWKQ0Ij8IdddjyBFE4T2kagL/x6M3+4zUgc+4qTOUBoNe4XxDskt1HPKO007ZPiMgLDq2s7Kw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.25.7",
-        "@babel/types": "^7.25.7"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.25.7.tgz",
-      "integrity": "sha512-k/6f8dKG3yDz/qCwSM+RKovjMix563SLxQFo0UhRNo239SP6n9u5/eLtKD6EAjwta2JHJ49CsD8pms2HdNiMMQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.25.7",
-        "@babel/helper-simple-access": "^7.25.7",
-        "@babel/helper-validator-identifier": "^7.25.7",
-        "@babel/traverse": "^7.25.7"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -195,24 +192,10 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/helper-simple-access": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.25.7.tgz",
-      "integrity": "sha512-FPGAkJmyoChQeM+ruBGIDyrT2tKfZJO8NcxdC+CWNJi7N8/rZpSxK7yvBJ5O/nF1gfu5KzN7VKG3YVSLFfRSxQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/traverse": "^7.25.7",
-        "@babel/types": "^7.25.7"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.25.7.tgz",
-      "integrity": "sha512-CbkjYdsJNHFk8uqpEkpCvRs3YRp9tY6FmFY7wLMSYuGYkrdUi7r2lc4/wqsvlHoMznX3WJ9IP8giGPq68T/Y6g==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -220,9 +203,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.25.7.tgz",
-      "integrity": "sha512-AM6TzwYqGChO45oiuPqwL2t20/HdMC1rTPAesnBCgPCSF1x3oN9MVUwQV2iyz4xqWrctwK5RNC8LV22kaQCNYg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -230,9 +213,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.25.7.tgz",
-      "integrity": "sha512-ytbPLsm+GjArDYXJ8Ydr1c/KJuutjF2besPNbIZnZ6MKUxi/uTA22t2ymmA4WFjZFpjiAMO0xuuJPqK2nvDVfQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -240,121 +223,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.25.7.tgz",
-      "integrity": "sha512-Sv6pASx7Esm38KQpF/U/OXLwPPrdGHNKoeblRxgZRLXnAtnkEe4ptJPDtAZM7fBLadbc1Q07kQpSiGQ0Jg6tRA==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.10.tgz",
+      "integrity": "sha512-EMCx3AGZ3WfAl6ht7AyQoPm2Lh+BGYEMdc4Q6Hf7uSCDOZFuLq44qNwL+iaim8VlyYhRAo4X43+weadK8ZB4Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.25.7",
-        "@babel/types": "^7.25.7"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/highlight": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.25.7.tgz",
-      "integrity": "sha512-iYyACpW3iW8Fw+ZybQK+drQre+ns/tKpXbNESfrhNnPLIklLbXr7MYJ6gPEd0iETGLOK+SxMjVvKb/ffmk+FEw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.25.7",
-        "chalk": "^2.4.2",
-        "js-tokens": "^4.0.0",
-        "picocolors": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@babel/highlight/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/@babel/parser": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.25.7.tgz",
-      "integrity": "sha512-aZn7ETtQsjjGG5HruveUK06cU3Hljuhd9Iojm4M8WWv3wLE6OkE5PWbDUkItmMgegmccaITudyuW5RPYrYlgWw==",
+      "version": "7.29.9",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz",
+      "integrity": "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.25.7"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -587,49 +476,48 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.25.7.tgz",
-      "integrity": "sha512-wRwtAgI3bAS+JGU2upWNL9lSlDcRCqD05BZ1n3X2ONLH1WilFP6O1otQjeMK/1g0pvYcXC7b/qVUB1keofjtZA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.25.7",
-        "@babel/parser": "^7.25.7",
-        "@babel/types": "^7.25.7"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.25.7.tgz",
-      "integrity": "sha512-jatJPT1Zjqvh/1FyJs6qAHL+Dzb7sTb+xr7Q+gM1b+1oBsMsQQ4FkVKb6dFlJvLlVssqkRzV05Jzervt9yhnzg==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.10.tgz",
+      "integrity": "sha512-B3lYAs2nkKskbgQ1nfy8Ma9ao9Q1rntTAQHrzzyDuj+TSO+X3le6PfWwqDvodsb+OumE10eMFfuMCTQSQ5iuIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.25.7",
-        "@babel/generator": "^7.25.7",
-        "@babel/parser": "^7.25.7",
-        "@babel/template": "^7.25.7",
-        "@babel/types": "^7.25.7",
-        "debug": "^4.3.1",
-        "globals": "^11.1.0"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.9",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
+        "debug": "^4.3.1"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.25.7",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.25.7.tgz",
-      "integrity": "sha512-vwIVdXG+j+FOpkwqHRcBgHLYNL7XMkufrlaFvL9o6Ai9sJn9+PdyIL5qa0XzTZw084c+u9LOls53eoZWP/W5WQ==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.25.7",
-        "@babel/helper-validator-identifier": "^7.25.7",
-        "to-fast-properties": "^2.0.0"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -935,18 +823,25 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
-      "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/set-array": "^1.2.1",
-        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
         "@jridgewell/trace-mapping": "^0.3.24"
-      },
-      "engines": {
-        "node": ">=6.0.0"
       }
     },
     "node_modules/@jridgewell/resolve-uri": {
@@ -959,27 +854,17 @@
         "node": ">=6.0.0"
       }
     },
-    "node_modules/@jridgewell/set-array": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
-      "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz",
-      "integrity": "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.25",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
-      "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1497,10 +1382,23 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.11.27",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.27.tgz",
+      "integrity": "sha512-ElY12DaROGuan+lMmZ8Cvo/ZUbXPe7Enc/9VU/b1T3Kp4dwytRcNdR8DoSJN5SNJT/CuvcCA0DHDVmMOCePdRQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1529,9 +1427,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/browserslist": {
-      "version": "4.24.0",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.0.tgz",
-      "integrity": "sha512-Rmb62sR1Zpjql25eSanFGEhAxcFwfA1K0GuQcLoaJBAcENegrQut3hYdhXFF1obQfiDyqIW/cLM5HSJ/9k884A==",
+      "version": "4.29.3",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.3.tgz",
+      "integrity": "sha512-1R4kiYKXGViqEN0CnoDrXc1StD9niAwu+j2dukWzrD4bJgsD4lDmEp0CRbc6E/vYJIfTHwPmwyaKtVSudICdPA==",
       "dev": true,
       "funding": [
         {
@@ -1549,10 +1447,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "caniuse-lite": "^1.0.30001663",
-        "electron-to-chromium": "^1.5.28",
-        "node-releases": "^2.0.18",
-        "update-browserslist-db": "^1.1.0"
+        "baseline-browser-mapping": "^2.11.26",
+        "caniuse-lite": "^1.0.30001813",
+        "electron-to-chromium": "^1.5.439",
+        "node-releases": "^2.0.57",
+        "update-browserslist-db": "^1.3.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1636,9 +1535,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001667",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001667.tgz",
-      "integrity": "sha512-7LTwJjcRkzKFmtqGsibMeuXmvFDfZq/nzIjnmgCGzKKRVzjD72selLDK1oPF/Oxzmt4fNcPvTDvGqSDG4tCALw==",
+      "version": "1.0.30001815",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001815.tgz",
+      "integrity": "sha512-uDybUEyfgbyJJ93J1vikTylBX31AkdVYeVPeffMQpf8XN7hSfr0oZOn4VFOIMNvtU5+rHvC5Udg2TgtJKHm23Q==",
       "dev": true,
       "funding": [
         {
@@ -1980,9 +1879,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.32",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.32.tgz",
-      "integrity": "sha512-M+7ph0VGBQqqpTT2YrabjNKSQ2fEl9PVx6AK3N558gDH9NO8O6XN9SXXFWRo9u9PbEg/bWq+tjXQr+eXmxubCw==",
+      "version": "1.5.451",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.451.tgz",
+      "integrity": "sha512-vUNKPrUzw8ByEMOxloq0a71iD/mPuPxVkbDm3G5YhnxTzOw/I6qAg2MUS0cYj/c267lWmw26yW4Vv7foxTxPLg==",
       "dev": true,
       "license": "ISC"
     },
@@ -2444,16 +2343,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/globals": {
-      "version": "11.12.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/gopd": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
@@ -3494,9 +3383,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3852,11 +3741,14 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
-      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
+      "version": "2.0.57",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.57.tgz",
+      "integrity": "sha512-kQK9LGGFiHtrWiNhZtA7Qbw17AQz+dmsEKODRIVTXA9+e5MS/2gZEBhYJt13GrAz5/IOZKddH/0Z3TP/Zgo+yw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -4024,9 +3916,9 @@
       "license": "MIT"
     },
     "node_modules/picocolors": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.0.tgz",
-      "integrity": "sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4578,16 +4470,6 @@
       "dev": true,
       "license": "BSD-3-Clause"
     },
-    "node_modules/to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -4740,9 +4622,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
-      "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.4.tgz",
+      "integrity": "sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==",
       "dev": true,
       "funding": [
         {
@@ -4761,7 +4643,7 @@
       "license": "MIT",
       "dependencies": {
         "escalade": "^3.2.0",
-        "picocolors": "^1.1.0"
+        "picocolors": "^1.1.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"

test/unit/node/cli.test.ts

@@ -1,10 +1,12 @@
 import { Level, logger } from "@coder/logger"
 import { promises as fs } from "fs"
+import * as os from "os"
 import * as path from "path"
 import {
   UserProvidedArgs,
   bindAddrFromArgs,
   defaultConfigFile,
+  defaultSessionSocket,
   parse,
   parseConfigFile,
   setDefaults,
@@ -37,7 +39,7 @@ const defaults = {
   usingEnvHashedPassword: false,
   "extensions-dir": path.join(paths.data, "extensions"),
   "user-data-dir": paths.data,
-  "session-socket": path.join(paths.data, "code-server-ipc.sock"),
+  "session-socket": defaultSessionSocket(paths.data),
   "app-name": "code-server",
   _: [],
 }
@@ -267,6 +269,16 @@ describe("parser", () => {
     expect(() => parse(["--log", "invalid"])).toThrowError(/--log valid values: \[trace, debug, info, warn, error\]/)
   })
 
+  it("should error if idle-timeout-seconds is too low", () => {
+    expect(() => parse(["--idle-timeout-seconds=60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(() => parse(["--idle-timeout-seconds", "60"])).toThrowError(
+      /--idle-timeout-seconds must be greater than 60 seconds/,
+    )
+    expect(parse(["--idle-timeout-seconds", "61"])).toEqual({ "idle-timeout-seconds": 61 })
+  })
+
   it("should error if the option doesn't exist", () => {
     expect(() => parse(["--foo"])).toThrowError(/Unknown option --foo/)
   })
@@ -564,9 +576,33 @@ describe("parser", () => {
       "install-extension": ["extension.number1", "extension.number2"],
     })
   })
+  it("should expand ~ in path options from the config file", () => {
+    const configContents = `
+      user-data-dir: ~/.config/code-server-data
+      extensions-dir: ~/extensions
+    `
+    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
+      config: "/fake-config-path",
+      "user-data-dir": path.join(os.homedir(), ".config/code-server-data"),
+      "extensions-dir": path.join(os.homedir(), "extensions"),
+    })
+  })
   it("should ignore optional strings set to false", async () => {
     expect(parse(["--cert=false"])).toEqual({})
   })
+  it("should ignore booleans set to false", async () => {
+    expect(parse(["--disable-telemetry=false"])).toEqual({})
+  })
+  it("should parse booleans set to false in the config file", () => {
+    const configContents = `
+      disable-telemetry: false
+      disable-update-check: true
+    `
+    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
+      config: "/fake-config-path",
+      "disable-update-check": true,
+    })
+  })
   it("should use last flag", async () => {
     expect(parse(["--port", "8081", "--port", "8082"])).toEqual({
       port: 8082,
@@ -977,6 +1013,26 @@ describe("bindAddrFromArgs", () => {
   })
 })
 
+describe("defaultSessionSocket", () => {
+  const dataDir = path.join("/home/coder/.local/share", "code-server")
+
+  it("should put the socket in the user data directory", () => {
+    expect(defaultSessionSocket(dataDir, "linux")).toBe(path.join(dataDir, "code-server-ipc.sock"))
+  })
+
+  it("should use a named pipe on windows", () => {
+    expect(defaultSessionSocket(dataDir, "win32")).toMatch(/^\\\\\.\\pipe\\code-server-ipc-[0-9a-f]{16}$/)
+  })
+
+  it("should give separate data directories separate pipes", () => {
+    expect(defaultSessionSocket(dataDir, "win32")).not.toBe(defaultSessionSocket(dataDir + "-other", "win32"))
+  })
+
+  it("should give one data directory one pipe however it is spelled", () => {
+    expect(defaultSessionSocket(dataDir.toUpperCase(), "win32")).toBe(defaultSessionSocket(dataDir, "win32"))
+  })
+})
+
 describe("defaultConfigFile", () => {
   it("should return the default config file as a string", async () => {
     const password = await generatePassword()
@@ -1036,6 +1092,13 @@ describe("toCodeArgs", () => {
     })
   })
 
+  it("should pass through --enable-remote-storage", async () => {
+    expect(await toCodeArgs(await setDefaults(parse(["--enable-remote-storage"])))).toStrictEqual({
+      ...vscodeDefaults,
+      "enable-remote-storage": true,
+    })
+  })
+
   it("should collect a repeated --vscode-option into an array", async () => {
     const args = parse([
       "--vscode-option",

test/unit/node/routes/login.test.ts

@@ -75,6 +75,17 @@ describe("login", () => {
       expect(htmlContent).toContain("Missing password")
     })
 
+    it("should reject compressed request bodies", async () => {
+      for (const encoding of ["br", "gzip", "deflate"]) {
+        const resp = await codeServer().fetch("/login", {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", "Content-Encoding": encoding },
+          body: "password=test",
+        })
+        expect(resp.status).toBe(415)
+      }
+    })
+
     it("should return HTML with 'Incorrect password' message", async () => {
       const params = new URLSearchParams()
       params.append("password", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")

test/unit/node/util.test.ts

@@ -1,5 +1,6 @@
 import * as cp from "child_process"
 import { promises as fs } from "fs"
+import * as os from "os"
 import * as path from "path"
 import { generateUuid } from "../../../src/common/util"
 import { tmpdir } from "../../../src/node/constants"
@@ -623,3 +624,18 @@ describe("splitOnFirstEquals", () => {
     })
   })
 })
+
+describe("expandTilde", () => {
+  it("should expand a bare ~", () => {
+    expect(util.expandTilde("~")).toBe(os.homedir())
+  })
+  it("should expand a leading ~/", () => {
+    expect(util.expandTilde("~/.config/code-server")).toBe(path.join(os.homedir(), ".config/code-server"))
+  })
+  it("should leave other paths alone", () => {
+    expect(util.expandTilde("/tmp/~/data")).toBe("/tmp/~/data")
+    expect(util.expandTilde("relative/~")).toBe("relative/~")
+    expect(util.expandTilde("~user/data")).toBe("~user/data")
+    expect(util.expandTilde("")).toBe("")
+  })
+})