Upgrade brace-expansion sub-dependency

Courtesy of `npm audit fix`.
chore: bump qs from 6.13.0 to 6.14.0 (#7363 )
2026-04-13 21:32:52 -05:00 · 2025-06-16 17:00:51 -08:00 · 2025-06-16 15:32:23 -08:00 · 2025-06-16 15:32:00 -08:00 · 2025-06-16 13:07:03 -08:00 · 2025-06-16 13:06:23 -08:00
82 changed files with 1832 additions and 2258 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,2 @@
+# Prettier 3.4.2
+9b0340a09276f93c054d705d1b9a5f24cc5dbc97
--- a/.github/ISSUE_TEMPLATE/bug-report.yml
+++ b/.github/ISSUE_TEMPLATE/bug-report.yml
@@ -20,6 +20,8 @@ body:
          - **Remote OS**: Ubuntu
          - **Remote Architecture**: amd64
          - **`code-server --version`**: 4.0.1
+
+        Please do not just put "latest" for the version.
      value: |
        - Web Browser:
        - Local OS:
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -22,119 +22,114 @@ concurrency:
 # will skip running `npm install` if it successfully fetched from cache

 jobs:
-  prettier:
-    name: Format with Prettier
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      ci: ${{ steps.filter.outputs.ci }}
+      code: ${{ steps.filter.outputs.code }}
+      deps: ${{ steps.filter.outputs.deps }}
+      docs: ${{ steps.filter.outputs.docs }}
+      helm: ${{ steps.filter.outputs.helm }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
-
-      - name: Run prettier with actionsx/prettier
-        uses: actionsx/prettier@v3
+      - name: Check changed files
+        uses: dorny/paths-filter@v3
+        id: filter
        with:
-          args: --check --log-level=warn .
+          filters: |
+            ci:
+              - ".github/**"
+              - "ci/**"
+            docs:
+              - "docs/**"
+              - "README.md"
+              - "CHANGELOG.md"
+            helm:
+              - "ci/helm-chart/**"
+            code:
+              - "src/**"
+              - "test/**"
+            deps:
+              - "lib/**"
+              - "patches/**"
+              - "package-lock.json"
+              - "test/package-lock.json"
+      - id: debug
+        run: |
+          echo "${{ toJSON(steps.filter )}}"
+
+  prettier:
+    name: Run prettier check
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            test/package-lock.json
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npx prettier --check .

  doctoc:
    name: Doctoc markdown files
    runs-on: ubuntu-22.04
    timeout-minutes: 5
+    needs: changes
+    if: needs.changes.outputs.docs == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v45
-        with:
-          files: |
-            docs/**
-
-      - name: Install Node.js
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: npm run doctoc
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npm run doctoc

  lint-helm:
    name: Lint Helm chart
    runs-on: ubuntu-22.04
    timeout-minutes: 5
+    needs: changes
+    if: needs.changes.outputs.helm == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v45
-        with:
-          files: |
-            ci/helm-chart/**
-
-      - name: Install helm
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: azure/setup-helm@v4
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: helm plugin install https://github.com/instrumenta/helm-kubeval
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: helm kubeval ci/helm-chart
+      - run: helm plugin install https://github.com/instrumenta/helm-kubeval
+      - run: helm kubeval ci/helm-chart

  lint-ts:
    name: Lint TypeScript files
    runs-on: ubuntu-22.04
    timeout-minutes: 5
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v45
-        with:
-          files: |
-            **/*.ts
-            **/*.js
-          files_ignore: |
-            lib/vscode/**
-
-      - name: Install Node.js
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Lint TypeScript files
-        if: steps.changed-files.outputs.any_changed == 'true'
-        run: npm run lint:ts
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npm run lint:ts

  lint-actions:
    name: Lint GitHub Actions
    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.ci == 'true'
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -148,42 +143,23 @@ jobs:
    name: Run unit tests
    runs-on: ubuntu-22.04
    timeout-minutes: 5
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@v45
-        with:
-          files: |
-            **/*.ts
-          files_ignore: |
-            lib/vscode/**
-
-      - name: Install Node.js
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - if: steps.changed-files.outputs.any_changed == 'true'
-        run: npm run test:unit
-
-      - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v4
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - run: npm run test:unit
+      - uses: codecov/codecov-action@v5
+        if: success()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
-        if: success()

  build:
    name: Build code-server
@@ -193,44 +169,31 @@ jobs:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      DISABLE_V8_COMPILE_CACHE: 1
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
        with:
          submodules: true
-
-      - name: Install system dependencies
-        run: sudo apt update && sudo apt install -y libkrb5-dev
-
-      - name: Install quilt
-        uses: awalsh128/cache-apt-pkgs-action@latest
+      - run: sudo apt update && sudo apt install -y libkrb5-dev
+      - uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: quilt
          version: 1.0
-
-      - name: Patch Code
-        run: quilt push -a
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+      - run: quilt push -a
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - env:
+      - run: npm run build
+        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run build
-
      # Get Code's git hash.  When this changes it means the content is
      # different and we need to rebuild.
      - name: Get latest lib/vscode rev
        id: vscode-rev
        run: echo "rev=$(git rev-parse HEAD:./lib/vscode)" >> $GITHUB_OUTPUT
-
      # We need to rebuild when we have a new version of Code, when any of
      # the patches changed, or when the code-server version changes (since
      # it gets embedded into the code).  Use VSCODE_CACHE_VERSION to
@@ -241,7 +204,6 @@ jobs:
        with:
          path: lib/vscode-reh-web-*
          key: vscode-reh-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }}
-
      - name: Build vscode
        env:
          VERSION: "0.0.0"
@@ -251,107 +213,77 @@ jobs:
          npm ci
          popd
          npm run build:vscode
-
      # The release package does not contain any native modules
      # and is neutral to architecture/os/libc version.
      - run: npm run release
        if: success()
-
      # https://github.com/actions/upload-artifact/issues/38
      - run: tar -czf package.tar.gz release
-
-      - name: Upload npm package artifact
-        uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4
        with:
          name: npm-package
          path: ./package.tar.gz

  test-e2e:
    name: Run e2e tests
-    needs: build
    runs-on: ubuntu-22.04
    timeout-minutes: 25
+    needs: [changes, build]
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: sudo apt update && sudo apt install -y libkrb5-dev
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - run: sudo apt update && sudo apt install -y libkrb5-dev
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v4
        with:
          name: npm-package
-
      - run: tar -xzf package.tar.gz
-
      - run: cd release && npm install --unsafe-perm --omit=dev
-
      - name: Install Playwright OS dependencies
        run: |
          ./test/node_modules/.bin/playwright install-deps
          ./test/node_modules/.bin/playwright install
-
      - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e
-
-      - name: Upload test artifacts
+      - uses: actions/upload-artifact@v4
        if: always()
-        uses: actions/upload-artifact@v4
        with:
          name: failed-test-videos
          path: ./test/test-results
-
-      - name: Remove release packages and test artifacts
-        run: rm -rf ./release ./test/test-results
+      - run: rm -rf ./release ./test/test-results

  test-e2e-proxy:
    name: Run e2e tests behind proxy
-    needs: build
    runs-on: ubuntu-22.04
    timeout-minutes: 25
+    needs: [changes, build]
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: sudo apt update && sudo apt install -y libkrb5-dev
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - run: sudo apt update && sudo apt install -y libkrb5-dev
+      - uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm
          cache-dependency-path: |
            package-lock.json
            test/package-lock.json
-
      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v4
        with:
          name: npm-package
-
      - run: tar -xzf package.tar.gz
-
      - run: cd release && npm install --unsafe-perm --omit=dev
-
      - name: Install Playwright OS dependencies
        run: |
          ./test/node_modules/.bin/playwright install-deps
          ./test/node_modules/.bin/playwright install
-
      - name: Cache Caddy
        uses: actions/cache@v4
        id: caddy-cache
@@ -359,7 +291,6 @@ jobs:
          path: |
            ~/.cache/caddy
          key: cache-caddy-2.5.2
-
      - name: Install Caddy
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -368,16 +299,13 @@ jobs:
          gh release download v2.5.2 --repo caddyserver/caddy --pattern "caddy_2.5.2_linux_amd64.tar.gz"
          mkdir -p ~/.cache/caddy
          tar -xzf caddy_2.5.2_linux_amd64.tar.gz --directory ~/.cache/caddy
-
-      - run: sudo ~/.cache/caddy/caddy start --config ./ci/Caddyfile
-
+      - run: ~/.cache/caddy/caddy start --config ./ci/Caddyfile
      - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e:proxy
+      - run: ~/.cache/caddy/caddy stop --config ./ci/Caddyfile
+        if: always()

-      - if: always()
-        run: sudo ~/.cache/caddy/caddy stop --config ./ci/Caddyfile
-
-      - if: always()
-        uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4
+        if: always()
        with:
          name: failed-test-videos-proxy
          path: ./test/test-results
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -33,7 +33,7 @@ jobs:
          node-version-file: .node-version

      - name: Download npm package from release artifacts
-        uses: robinraju/release-downloader@v1.11
+        uses: robinraju/release-downloader@v1.12
        with:
          repository: "coder/code-server"
          tag: ${{ github.event.inputs.version || github.ref_name }}
@@ -124,7 +124,7 @@ jobs:
          echo "VERSION=${TAG#v}" >> $GITHUB_ENV

      - name: Validate package
-        uses: heyhusen/archlinux-package-action@v2.2.1
+        uses: heyhusen/archlinux-package-action@v2.4.0
        env:
          VERSION: ${{ env.VERSION }}
        with:
@@ -145,7 +145,7 @@ jobs:
          gh pr create --repo coder/code-server-aur --title "chore: bump version to ${{ env.VERSION }}" --body "PR opened by @$GITHUB_ACTOR" --assignee $GITHUB_ACTOR

  docker:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout code-server
        uses: actions/checkout@v4
@@ -176,7 +176,7 @@ jobs:
          echo "VERSION=${TAG#v}" >> $GITHUB_ENV

      - name: Download deb artifacts
-        uses: robinraju/release-downloader@v1.11
+        uses: robinraju/release-downloader@v1.12
        with:
          repository: "coder/code-server"
          tag: v${{ env.VERSION }}
@@ -184,7 +184,7 @@ jobs:
          out-file-path: "release-packages"

      - name: Download rpm artifacts
-        uses: robinraju/release-downloader@v1.11
+        uses: robinraju/release-downloader@v1.12
        with:
          repository: "coder/code-server"
          tag: v${{ env.VERSION }}
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,95 +19,27 @@ concurrency:
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

 jobs:
-  package-linux-amd64:
-    name: x86-64 Linux build
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: npm-version
-    container: "centos:8"
-    env:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Install development tools
-        run: |
-          cd /etc/yum.repos.d/
-          sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
-          sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
-          yum install -y gcc-c++ make jq rsync python3 libsecret-devel krb5-devel
-
-      - name: Install nfpm and envsubst
-        run: |
-          mkdir -p ~/.local/bin
-          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.22.2/nfpm_2.22.2_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
-          curl -sSfL https://github.com/a8m/envsubst/releases/download/v1.1.0/envsubst-`uname -s`-`uname -m` -o envsubst
-          chmod +x envsubst
-          mv envsubst ~/.local/bin
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
-        with:
-          name: npm-release-package
-
-      - run: tar -xzf package.tar.gz
-
-      - run: npm run release:standalone
-
-      - run: npm run test:integration
-
-      - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-        if: success()
-        continue-on-error: true
-
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - env:
-          VERSION: ${{ env.VERSION }}
-        run: npm run package
-
-      - uses: softprops/action-gh-release@v1
-        with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./release-packages/*
-
  package-linux-cross:
-    name: Linux cross-compile builds
+    name: ${{ matrix.prefix }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: npm-version
-    container: "debian:buster"
+    container: "python:3.8-slim-buster"
    strategy:
      matrix:
        include:
+          - prefix: x86_64-linux-gnu
+            npm_arch: x64
+            apt_arch: amd64
+            package_arch: amd64
          - prefix: aarch64-linux-gnu
            npm_arch: arm64
            apt_arch: arm64
+            package_arch: arm64
          - prefix: arm-linux-gnueabihf
            npm_arch: armv7l
            apt_arch: armhf
+            package_arch: armv7l

    env:
      AR: ${{ format('{0}-ar', matrix.prefix) }}
@@ -121,6 +53,7 @@ jobs:
      PKG_CONFIG_PATH: ${{ format('/usr/lib/{0}/pkgconfig', matrix.prefix) }}
      TARGET_ARCH: ${{ matrix.apt_arch }}
      npm_config_arch: ${{ matrix.npm_arch }}
+      PKG_ARCH: ${{ matrix.package_arch }}
      # Not building from source results in an x86_64 argon2, as if
      # npm_config_arch is being ignored.
      npm_config_build_from_source: true
@@ -141,7 +74,7 @@ jobs:
      - name: Install cross-compiler and system dependencies
        run: |
          dpkg --add-architecture $TARGET_ARCH
-          apt-get update && apt-get install -y --no-install-recommends \
+          apt update && apt install -y --no-install-recommends \
            crossbuild-essential-$TARGET_ARCH \
            libx11-dev:$TARGET_ARCH \
            libx11-xcb-dev:$TARGET_ARCH \
@@ -149,8 +82,7 @@ jobs:
            libsecret-1-dev:$TARGET_ARCH \
            libkrb5-dev:$TARGET_ARCH \
            ca-certificates \
-            curl wget rsync gettext-base \
-            python3
+            curl wget rsync gettext-base

      - run: SKIP_SUBMODULE_DEPS=1 npm ci

@@ -183,7 +115,7 @@ jobs:

      - env:
          VERSION: ${{ env.VERSION }}
-        run: npm run package ${npm_config_arch}
+        run: npm run package $PKG_ARCH

      - uses: softprops/action-gh-release@v1
        with:
@@ -193,9 +125,73 @@ jobs:

  package-macos-amd64:
    name: x86-64 macOS build
+    runs-on: macos-13
+    timeout-minutes: 15
+    needs: npm-version
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            test/package-lock.json
+
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+
+      - name: Install nfpm
+        run: |
+          mkdir -p ~/.local/bin
+          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      # The version of node-gyp we use depends on distutils but it was removed
+      # in Python 3.12.  It seems to be fixed in the latest node-gyp so when we
+      # next update Node we can probably remove this.  For now, install
+      # setuptools since it contains distutils.
+      - run: brew install python-setuptools
+
+      - name: Download npm package
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-release-package
+
+      - run: tar -xzf package.tar.gz
+      - run: npm run release:standalone
+      - run: npm run test:native
+
+      # Strip out the v (v4.9.1 -> 4.9.1).
+      - name: Get and set VERSION
+        run: |
+          TAG="${{ inputs.version || github.ref_name }}"
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+
+      - name: Build packages with nfpm
+        env:
+          VERSION: ${{ env.VERSION }}
+        run: npm run package
+
+      - uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          discussion_category_name: "📣 Announcements"
+          files: ./release-packages/*
+
+  package-macos-arm64:
+    name: arm64 macOS build
    runs-on: macos-latest
    timeout-minutes: 15
    needs: npm-version
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -272,7 +268,7 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Download artifacts
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v10
        id: download
        with:
          branch: ${{ github.ref }}
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -43,7 +43,7 @@ jobs:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -51,7 +51,7 @@ jobs:
          fetch-depth: 0

      - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
+        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5
        with:
          scan-type: "fs"
          scan-ref: "."
@@ -72,7 +72,7 @@ jobs:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/autobuild to send a status report
    name: Analyze with CodeQL
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04

    steps:
      - name: Checkout repository
--- a/.github/workflows/trivy-docker.yaml
+++ b/.github/workflows/trivy-docker.yaml
@@ -44,14 +44,14 @@ concurrency:

 jobs:
  trivy-scan-image:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner in image mode
-        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
+        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5
        with:
          image-ref: "docker.io/codercom/code-server:latest"
          ignore-unfixed: true
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-20.18.0
+22.15.1
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,155 @@ Code v99.99.999

 ## Unreleased

+## [4.100.3](https://github.com/coder/code-server/releases/tag/v4.100.3) - 2025-06-03
+
+Code v1.100.3
+
+### Changed
+
+- Update to Code 1.100.3.
+
+## [4.100.2](https://github.com/coder/code-server/releases/tag/v4.100.2) - 2025-05-15
+
+Code v1.100.2
+
+### Changed
+
+- Update to Code 1.100.2.
+
+## [4.100.1](https://github.com/coder/code-server/releases/tag/v4.100.1) - 2025-05-13
+
+Code v1.100.1
+
+### Changed
+
+- Update to Code 1.100.1.
+
+## [4.100.0](https://github.com/coder/code-server/releases/tag/v4.100.0) - 2025-05-12
+
+Code v1.100.0
+
+### Added
+
+- Trusted domains for links can now be set at run-time by configuring
+  `linkProtectionTrustedDomains` in the `lib/vscode/product.json` file or via
+  the `--link-protection-trusted-domains` flag.
+
+### Changed
+
+- Update to Code 1.100.0.
+- Disable extension signature verification, which previously was skipped by
+  default (the package used for verification is not available to OSS builds of
+  VS Code) but now reportedly throws hard errors making it impossible to install
+  extensions.
+
+### Fixed
+
+- Flags with repeatable options now work via the config file.
+
+## [4.99.4](https://github.com/coder/code-server/releases/tag/v4.99.4) - 2025-05-02
+
+Code v1.99.3
+
+### Security
+
+- Validate that ports in the path proxy are numbers, to prevent proxying to
+  arbitrary domains.
+
+## [4.99.3](https://github.com/coder/code-server/releases/tag/v4.99.3) - 2025-04-17
+
+Code v1.99.3
+
+### Added
+
+- Added `--skip-auth-preflight` flag to let preflight requests through the
+  proxy.
+
+### Changed
+
+- Update to Code 1.99.3.
+
+## [4.99.2](https://github.com/coder/code-server/releases/tag/v4.99.2) - 2025-04-10
+
+Code v1.99.2
+
+### Changed
+
+- Update to Code 1.99.2.
+
+## [4.99.1](https://github.com/coder/code-server/releases/tag/v4.99.1) - 2025-04-08
+
+Code v1.99.1
+
+### Changed
+
+- Update to Code 1.99.1.
+
+## [4.99.0](https://github.com/coder/code-server/releases/tag/v4.99.0) - 2025-04-07
+
+Code v1.99.0
+
+### Changed
+
+- Update to Code 1.99.0.
+
+## [4.98.0](https://github.com/coder/code-server/releases/tag/v4.98.0) - 2025-03-07
+
+Code v1.98.0
+
+### Changed
+
+- Update to Code 1.98.0.
+
+## [4.97.2](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-02-18
+
+Code v1.97.2
+
+### Added
+
+- Added back macOS amd64 builds.
+
+### Changed
+
+- Update to Code 1.97.2.
+- Softened dark mode login page colors.
+
+## [4.96.4](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-01-20
+
+Code v1.96.4
+
+### Changed
+
+- Update to Code 1.96.4.
+
+## [4.96.2](https://github.com/coder/code-server/releases/tag/v4.96.2) - 2024-12-20
+
+Code v1.96.2
+
+### Changed
+
+- Update to Code 1.96.2.
+
+## [4.96.1](https://github.com/coder/code-server/releases/tag/v4.96.1) - 2024-12-18
+
+Code v1.96.1
+
+### Added
+
+- Dark color scheme for login and error pages.
+
+### Changed
+
+- Update to Code 1.96.1.
+
+## [4.95.3](https://github.com/coder/code-server/releases/tag/v4.95.3) - 2024-11-18
+
+Code v1.95.3
+
+### Changed
+
+- Update to Code 1.95.3.
+
 ## [4.95.2](https://github.com/coder/code-server/releases/tag/v4.95.2) - 2024-11-12

 Code v1.95.2
--- a/ci/build/build-release.sh
+++ b/ci/build/build-release.sh
@@ -44,10 +44,6 @@ bundle_code_server() {
  rsync src/browser/pages/*.css "$RELEASE_PATH/src/browser/pages"
  rsync src/browser/robots.txt "$RELEASE_PATH/src/browser"

-  # Add typings for plugins
-  mkdir -p "$RELEASE_PATH/typings"
-  rsync typings/pluginapi.d.ts "$RELEASE_PATH/typings"
-
  # Adds the commit to package.json
  jq --slurp '(.[0] | del(.scripts,.jest,.devDependencies)) * .[1]' package.json <(
    cat << EOF
--- a/ci/build/npm-postinstall.sh
+++ b/ci/build/npm-postinstall.sh
@@ -76,8 +76,8 @@ main() {
    echo "USE AT YOUR OWN RISK!"
  fi

-  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-20}" ]; then
-    echo "ERROR: code-server currently requires node v20."
+  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-22}" ]; then
+    echo "ERROR: code-server currently requires node v22."
    if [ -n "$FORCE_NODE_VERSION" ]; then
      echo "However, you have overrided the version check to use v$FORCE_NODE_VERSION."
    fi
--- a/ci/dev/test-integration.sh
+++ b/ci/dev/test-integration.sh
@@ -33,7 +33,7 @@ main() {
    exit 1
  fi

-  CODE_SERVER_PATH="$path" CS_DISABLE_PLUGINS=true ./test/node_modules/.bin/jest "$@" --coverage=false --testRegex "./test/integration" --testPathIgnorePatterns "./test/integration/fixtures"
+  CODE_SERVER_PATH="$path" ./test/node_modules/.bin/jest "$@" --coverage=false --testRegex "./test/integration" --testPathIgnorePatterns "./test/integration/fixtures"
 }

 main "$@"
--- a/ci/dev/test-unit.sh
+++ b/ci/dev/test-unit.sh
@@ -6,15 +6,10 @@ main() {

  source ./ci/lib.sh

-  echo "Building test plugin"
-  pushd test/unit/node/test-plugin
-  make -s out/index.js
-  popd
-
  # We must keep jest in a sub-directory. See ../../test/package.json for more
  # information. We must also run it from the root otherwise coverage will not
  # include our source files.
-  CS_DISABLE_PLUGINS=true ./test/node_modules/.bin/jest "$@" --testRegex "./test/unit/.*ts" --testPathIgnorePatterns "./test/unit/node/test-plugin"
+  ./test/node_modules/.bin/jest "$@" --testRegex "./test/unit/.*ts"
 }

 main "$@"
--- a/ci/helm-chart/Chart.yaml
+++ b/ci/helm-chart/Chart.yaml
@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.24.0
+version: 3.27.3

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.93.1
+appVersion: 4.100.3
--- a/ci/helm-chart/templates/deployment.yaml
+++ b/ci/helm-chart/templates/deployment.yaml
@@ -8,7 +8,7 @@ metadata:
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.replicaCount | default 1 }}
  strategy:
    type: Recreate
  selector:
@@ -35,8 +35,9 @@ spec:
      securityContext:
        fsGroup: {{ .Values.securityContext.fsGroup }}
      {{- end }}
-      {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
+      {{- if or (and .Values.volumePermissions.enabled .Values.persistence.enabled) .Values.extraInitContainers }}
      initContainers:
+      {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
      - name: init-chmod-data
        image: busybox:latest
        imagePullPolicy: IfNotPresent
@@ -50,6 +51,7 @@ spec:
        volumeMounts:
        - name: data
          mountPath: /home/coder
+      {{- end }}
 {{- if .Values.extraInitContainers }}
 {{ tpl .Values.extraInitContainers . | indent 6}}
 {{- end }}
--- a/ci/helm-chart/values.yaml
+++ b/ci/helm-chart/values.yaml
@@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: codercom/code-server
-  tag: '4.93.1'
+  tag: '4.100.3'
  pullPolicy: Always

 # Specifies one or more secrets to be used when pulling images from a
@@ -19,6 +19,9 @@ nameOverride: ""
 fullnameOverride: ""
 hostnameOverride: ""

+# The existing secret to use for code-server authentication in the frontend. the password is stored in the secret under the key `password`
+# existingSecret: ""
+
 serviceAccount:
  # Specifies whether a service account should be created
  create: true
--- a/ci/release-image/Dockerfile
+++ b/ci/release-image/Dockerfile
@@ -31,7 +31,10 @@ RUN sed -i "s/# en_US.UTF-8/en_US.UTF-8/" /etc/locale.gen \
  && locale-gen
 ENV LANG=en_US.UTF-8

-RUN adduser --gecos '' --disabled-password coder \
+RUN if grep -q 1000 /etc/passwd; then \
+    userdel -r "$(id -un 1000)"; \
+  fi \
+  && adduser --gecos '' --disabled-password coder \
  && echo "coder ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/nopasswd

 RUN ARCH="$(dpkg --print-architecture)" \
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -32,7 +32,7 @@ The prerequisites for contributing to code-server are almost the same as those
 for [VS Code](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites).
 Here is what is needed:

- `node` v20.x
+- `node` v22.x
 - `git` v2.x or greater
 - [`git-lfs`](https://git-lfs.github.com)
 - [`npm`](https://www.npmjs.com/)
--- a/docs/README.md
+++ b/docs/README.md
@@ -24,7 +24,7 @@ on how to set up a Google VM on which you can install code-server.

 ## Getting started

-There are four ways to get started:
+There are five ways to get started:

 1. Using the [install
   script](https://github.com/coder/code-server/blob/main/install.sh), which
@@ -35,6 +35,9 @@ There are four ways to get started:
 3. Deploy code-server to your team with [coder/coder](https://cdr.co/coder-github)
 4. Using our one-click buttons and guides to [deploy code-server to a cloud
   provider](https://github.com/coder/deploy-code-server) ⚡
+5. Using the [code-server feature for
+   devcontainers](https://github.com/coder/devcontainer-features/blob/main/src/code-server/README.md),
+   if you already use devcontainers in your project.

 If you use the install script, you can preview what occurs during the install
 process:
--- a/docs/android.md
+++ b/docs/android.md
@@ -11,7 +11,7 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
 ```

 6. Exit the terminal using `exit` and then reopen the terminal
-7. Install and use Node.js 20:
+7. Install and use Node.js 22:

 ```shell
 nvm install 18
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -21,6 +21,7 @@
  - [Proxying to an Angular app](#proxying-to-an-angular-app)
  - [Proxying to a Svelte app](#proxying-to-a-svelte-app)
  - [Prefixing `/absproxy/<port>` with a path](#prefixing-absproxyport-with-a-path)
+  - [Preflight requests](#preflight-requests)

 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 <!-- prettier-ignore-end -->
@@ -119,22 +120,22 @@ access code-server on an iPad or do not want to use SSH port forwarding.

 1. This option requires that the remote machine be exposed to the internet. Make sure that your instance allows HTTP/HTTPS traffic.

-1. You'll need a domain name (if you don't have one, you can purchase one from
+2. You'll need a domain name (if you don't have one, you can purchase one from
   [Google Domains](https://domains.google.com) or the domain service of your
-   choice)). Once you have a domain name, add an A record to your domain that contains your
+   choice). Once you have a domain name, add an A record to your domain that contains your
   instance's IP address.

-1. Install [Caddy](https://caddyserver.com/docs/download#debian-ubuntu-raspbian):
+3. Install [Caddy](https://caddyserver.com/docs/download#debian-ubuntu-raspbian):

-```console
-sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
-sudo apt update
-sudo apt install caddy
-```
+   ```console
+   sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
+   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+   sudo apt update
+   sudo apt install caddy
+   ```

-1. Replace `/etc/caddy/Caddyfile` using `sudo` so that the file looks like this:
+4. Replace `/etc/caddy/Caddyfile` using `sudo` so that the file looks like this:

   ```text
   mydomain.com {
@@ -153,7 +154,7 @@ sudo apt install caddy

   Remember to replace `mydomain.com` with your domain name!

-1. Reload Caddy:
+5. Reload Caddy:

   ```console
   sudo systemctl reload caddy
@@ -164,21 +165,22 @@ At this point, you should be able to access code-server via

 ### Using Let's Encrypt with NGINX

-1. This option requires that the remote machine be exposed to the internet. Make sure that your instance allows HTTP/HTTPS traffic.
+1. This option requires that the remote machine be exposed to the internet. Make
+   sure that your instance allows HTTP/HTTPS traffic.

-1. You'll need a domain name (if you don't have one, you can purchase one from
+2. You'll need a domain name (if you don't have one, you can purchase one from
   [Google Domains](https://domains.google.com) or the domain service of your
-   choice)). Once you have a domain name, add an A record to your domain that contains your
+   choice). Once you have a domain name, add an A record to your domain that contains your
   instance's IP address.

-1. Install NGINX:
+3. Install NGINX:

   ```bash
   sudo apt update
   sudo apt install -y nginx certbot python3-certbot-nginx
   ```

-1. Update `/etc/nginx/sites-available/code-server` using sudo with the following
+4. Update `/etc/nginx/sites-available/code-server` using sudo with the following
   configuration:

   ```text
@@ -199,13 +201,11 @@ At this point, you should be able to access code-server via

   Be sure to replace `mydomain.com` with your domain name!

-1. Enable the config:
-
+5. Enable the config:
   ```console
   sudo ln -s ../sites-available/code-server /etc/nginx/sites-enabled/code-server
   sudo certbot --non-interactive --redirect --agree-tos --nginx -d mydomain.com -m me@example.com
   ```
-
   Be sure to replace `me@example.com` with your actual email.

 At this point, you should be able to access code-server via
@@ -271,9 +271,9 @@ should see OSSStatus: 9836 in the browser console.
 If you want to use external authentication mechanism (e.g., Sign in with
 Google), you can do this with a reverse proxy such as:

- [Pomerium](https://www.pomerium.io/guides/code-server.html)
- [oauth2_proxy](https://github.com/pusher/oauth2_proxy)
- [Cloudflare Access](https://teams.cloudflare.com/access)
+- [Pomerium](https://www.pomerium.com/docs/guides/code-server.html)
+- [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/)
+- [Cloudflare Access](https://www.cloudflare.com/zero-trust/products/access/)

 ## HTTPS and self-signed certificates

@@ -292,7 +292,9 @@ redirect all HTTP requests to HTTPS.
 > You can use [Let's Encrypt](https://letsencrypt.org/) to get a TLS certificate
 > for free.

-Note: if you set `proxy_set_header Host $host;` in your reverse proxy config, it will change the address displayed in the green section of code-server in the bottom left to show the correct address.
+Note: if you set `proxy_set_header Host $host;` in your reverse proxy config, it
+will change the address displayed in the green section of code-server in the
+bottom left to show the correct address.

 ## Accessing web services

@@ -378,14 +380,16 @@ PUBLIC_URL=/absproxy/3000 \
  BROWSER=none yarn start
 ```

-You should then be able to visit `https://my-code-server-address.io/absproxy/3000` to see your app exposed through
-code-server!
+You should then be able to visit
+`https://my-code-server-address.io/absproxy/3000` to see your app exposed
+through code-server.

 > We highly recommend using the subdomain approach instead to avoid this class of issue.

 ### Proxying to a Vue app

-Similar to the situation with React apps, you have to make a few modifications to proxy a Vue app.
+Similar to the situation with React apps, you have to make a few modifications
+to proxy a Vue app.

 1. add `vue.config.js`
 2. update the values to match this (you can use any free port):
@@ -406,7 +410,8 @@ Read more about `publicPath` in the [Vue.js docs](https://cli.vuejs.org/config/#

 ### Proxying to an Angular app

-In order to use code-server's built-in proxy with Angular, you need to make the following changes in your app:
+In order to use code-server's built-in proxy with Angular, you need to make the
+following changes in your app:

 1. use `<base href="./.">` in `src/index.html`
 2. add `--serve-path /absproxy/4200` to `ng serve` in your `package.json`
@@ -415,7 +420,8 @@ For additional context, see [this GitHub Discussion](https://github.com/coder/co

 ### Proxying to a Svelte app

-In order to use code-server's built-in proxy with Svelte, you need to make the following changes in your app:
+In order to use code-server's built-in proxy with Svelte, you need to make the
+following changes in your app:

 1. Add `svelte.config.js` if you don't already have one
 2. Update the values to match this (you can use any free port):
@@ -436,9 +442,19 @@ For additional context, see [this Github Issue](https://github.com/sveltejs/kit/

 ### Prefixing `/absproxy/<port>` with a path

-This is a case where you need to serve an application via `absproxy` as explained above while serving `codeserver` itself from a path other than the root in your domain.
+This is a case where you need to serve an application via `absproxy` as
+explained above while serving code-server itself from a path other than the root
+in your domain.

-For example: `http://my-code-server.com/user/123/workspace/my-app`. To achieve this result:
+For example: `http://my-code-server.com/user/123/workspace/my-app`. To achieve
+this result:

-1. Start code server with the switch `--abs-proxy-base-path=/user/123/workspace`
+1. Start code-server with the switch `--abs-proxy-base-path=/user/123/workspace`
 2. Follow one of the instructions above for your framework.
+
+### Preflight requests
+
+By default, if you have auth enabled, code-server will authenticate all proxied
+requests including preflight requests. This can cause issues because preflight
+requests do not typically include credentials. To allow all preflight requests
+through the proxy without authentication, use `--skip-auth-preflight`.
--- a/docs/npm.md
+++ b/docs/npm.md
@@ -30,7 +30,7 @@ includes installing instructions based on your operating system.
 ## Node.js version

 We use the same major version of Node.js shipped with Code's remote, which is
-currently `20.x`. VS Code also [lists Node.js
+currently `22.x`. VS Code also [lists Node.js
 requirements](https://github.com/microsoft/vscode/wiki/How-to-Contribute#prerequisites).

 Using other versions of Node.js [may lead to unexpected
@@ -62,8 +62,7 @@ Proceed to [installing](#installing)
 ## Alpine

 ```bash
-apk add alpine-sdk bash libstdc++ libc6-compat
-npm config set python python3
+apk add alpine-sdk bash libstdc++ libc6-compat python3 krb5-dev
 ```

 Proceed to [installing](#installing)
@@ -79,7 +78,7 @@ Proceed to [installing](#installing)
 ## FreeBSD

 ```sh
-pkg install -y git python npm-node20 pkgconf
+pkg install -y git python npm-node22 pkgconf
 pkg install -y libinotify
 ```

--- a/docs/termux.md
+++ b/docs/termux.md
@@ -57,7 +57,7 @@ npm config set python python3
 node -v
 ```

-you will get Node version `v20`
+you will get Node version `v22`

 5. Now install code-server following our guide on [installing with npm](./npm.md)

--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1726560853,
-        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
@@ -20,11 +20,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1730359060,
-        "narHash": "sha256-Hkk0mf4pgvX9Ut0YA397nsFqMLhzFVBdFHc4PhBrxYE=",
+        "lastModified": 1739303263,
+        "narHash": "sha256-c/Z/6gZLN8BIpYh1B3qMzEn0TArjf4F2lmy59lDLVBM=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "e19cfce6f3f08d07653157d8826f5c920c770d7b",
+        "rev": "6cc4213488e886db863878a1e3dc26cc932d38b8",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -10,7 +10,7 @@
    flake-utils.lib.eachDefaultSystem
      (system:
        let pkgs = nixpkgs.legacyPackages.${system};
-            nodejs = pkgs.nodejs_20;
+            nodejs = pkgs.nodejs_22;
        in {
          devShells.default = pkgs.mkShell {
            nativeBuildInputs = with pkgs; [
--- a/lib/vscode
+++ b/lib/vscode
--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
    "publish:docker": "./ci/steps/docker-buildx-push.sh",
    "fmt": "npm run prettier && ./ci/dev/doctoc.sh",
    "lint:scripts": "./ci/dev/lint-scripts.sh",
-    "lint:ts": "eslint --max-warnings=0 --fix $(git ls-files '*.ts' '*.js' | grep -v 'lib/vscode' | grep -v test-plugin)",
+    "lint:ts": "eslint --max-warnings=0 --fix $(git ls-files '*.ts' '*.js' | grep -v 'lib/vscode')",
    "test": "echo 'Run npm run test:unit or npm run test:e2e' && exit 1",
    "watch": "VSCODE_DEV=1 VSCODE_IPC_HOOK_CLI= NODE_OPTIONS='--max_old_space_size=32384 --trace-warnings' ts-node ./ci/dev/watch.ts",
    "icons": "./ci/dev/gen_icons.sh"
@@ -44,10 +44,10 @@
    "@types/compression": "^1.7.3",
    "@types/cookie-parser": "^1.4.4",
    "@types/eslint__js": "^8.42.3",
-    "@types/express": "^4.17.17",
+    "@types/express": "^5.0.0",
    "@types/http-proxy": "1.17.7",
    "@types/js-yaml": "^4.0.6",
-    "@types/node": "20.x",
+    "@types/node": "22.x",
    "@types/pem": "^1.14.1",
    "@types/proxy-from-env": "^1.0.1",
    "@types/safe-compare": "^1.1.0",
@@ -60,8 +60,8 @@
    "eslint-import-resolver-typescript": "^3.6.0",
    "eslint-plugin-import": "^2.28.1",
    "eslint-plugin-prettier": "^5.0.0",
-    "globals": "^15.10.0",
-    "prettier": "^3.0.3",
+    "globals": "^16.1.0",
+    "prettier": "3.4.2",
    "prettier-plugin-sh": "^0.14.0",
    "ts-node": "^10.9.1",
    "typescript": "^5.6.2",
@@ -73,7 +73,7 @@
    "compression": "^1.7.4",
    "cookie-parser": "^1.4.6",
    "env-paths": "^2.2.1",
-    "express": "5.0.0-beta.3",
+    "express": "^5.0.1",
    "http-proxy": "^1.18.1",
    "httpolyglot": "^0.1.2",
    "i18next": "^23.5.1",
@@ -81,7 +81,7 @@
    "limiter": "^2.1.0",
    "pem": "^1.14.8",
    "proxy-agent": "^6.3.1",
-    "qs": "6.13.0",
+    "qs": "6.14.0",
    "rotating-file-stream": "^3.1.1",
    "safe-buffer": "^5.2.1",
    "safe-compare": "^1.1.4",
@@ -90,7 +90,7 @@
    "xdg-basedir": "^4.0.0"
  },
  "resolutions": {
-    "@types/node": "20.x"
+    "@types/node": "22.x"
  },
  "bin": {
    "code-server": "out/node/entry.js"
@@ -105,7 +105,7 @@
    "remote-development"
  ],
  "engines": {
-    "node": "20"
+    "node": "22"
  },
  "jest": {
    "transform": {
--- a/patches/base-path.diff
+++ b/patches/base-path.diff
@@ -111,21 +111,26 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -271,16 +271,15 @@ export class WebClientServer {
- 			return void res.end();
- 		}
+@@ -245,7 +245,9 @@ export class WebClientServer {
+ 		};
+ 
+ 		// Prefix routes with basePath for clients
+-		const basePath = getFirstHeader('x-forwarded-prefix') || this._basePath;
+		const rootBase = relativeRoot(getOriginalUrl(req))
+		const vscodeBase = relativePath(getOriginalUrl(req))
+		const basePath = vscodeBase || getFirstHeader('x-forwarded-prefix') || this._basePath;
+ 
+ 		const queryConnectionToken = parsedUrl.query[connectionTokenQueryName];
+ 		if (typeof queryConnectionToken === 'string') {
+@@ -284,10 +286,14 @@ export class WebClientServer {
+ 		};
 
-		const getFirstHeader = (headerName: string) => {
-			const val = req.headers[headerName];
-			return Array.isArray(val) ? val[0] : val;
-		};
-
 		const useTestResolver = (!this._environmentService.isBuilt && this._environmentService.args['use-test-resolver']);
 +		// For now we are getting the remote authority from the client to avoid
 +		// needing specific configuration for reverse proxies to work.  Set this to
 +		// something invalid to make sure we catch code that is using this value
 +		// from the backend when it should not.
- 		const remoteAuthority = (
+ 		let remoteAuthority = (
 			useTestResolver
 				? 'test+test'
 -				: (getFirstHeader('x-original-host') || getFirstHeader('x-forwarded-host') || req.headers.host)
@@ -133,43 +138,26 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 		);
 		if (!remoteAuthority) {
 			return serveError(req, res, 400, `Bad request.`);
-@@ -307,8 +306,12 @@ export class WebClientServer {
- 			scopes: [['user:email'], ['repo']]
- 		} : undefined;
+@@ -334,6 +340,7 @@ export class WebClientServer {
 
-+		const base = relativeRoot(getOriginalUrl(req))
-+		const vscodeBase = relativePath(getOriginalUrl(req))
-+
- 		const productConfiguration = {
+ 		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
 			codeServerVersion: this._productService.codeServerVersion,
-+			rootEndpoint: base,
+			rootEndpoint: rootBase,
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
 				...this._productService.extensionsGallery,
-@@ -337,7 +340,7 @@ export class WebClientServer {
- 			folderUri: resolveWorkspaceURI(this._environmentService.args['default-folder']),
- 			workspaceUri: resolveWorkspaceURI(this._environmentService.args['default-workspace']),
- 			productConfiguration,
-			callbackRoute: this._callbackRoute
-+			callbackRoute: vscodeBase + this._callbackRoute
- 		};
- 
- 		const cookies = cookie.parse(req.headers.cookie || '');
-@@ -354,9 +357,11 @@ export class WebClientServer {
- 		const values: { [key: string]: string } = {
- 			WORKBENCH_WEB_CONFIGURATION: asJSON(workbenchWebConfiguration),
+@@ -387,7 +394,9 @@ export class WebClientServer {
 			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
-			WORKBENCH_WEB_BASE_URL: this._staticRoute,
-+			WORKBENCH_WEB_BASE_URL: vscodeBase + this._staticRoute,
+ 			WORKBENCH_WEB_BASE_URL: staticRoute,
 			WORKBENCH_NLS_URL,
-			WORKBENCH_NLS_FALLBACK_URL: `${this._staticRoute}/out/nls.messages.js`
-+			WORKBENCH_NLS_FALLBACK_URL: `${vscodeBase}${this._staticRoute}/out/nls.messages.js`,
-+			BASE: base,
-+			VS_BASE: vscodeBase,
+-			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`
+			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
+			BASE: rootBase,
+			VS_BASE: basePath,
 		};
 
 		// DEV ---------------------------------------------------------------------------------------
-@@ -393,7 +398,7 @@ export class WebClientServer {
+@@ -424,7 +433,7 @@ export class WebClientServer {
 			'default-src \'self\';',
 			'img-src \'self\' https: data: blob:;',
 			'media-src \'self\';',
@@ -178,7 +166,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 			'child-src \'self\';',
 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
 			'worker-src \'self\' data: blob:;',
-@@ -466,3 +471,70 @@ export class WebClientServer {
+@@ -497,3 +506,70 @@ export class WebClientServer {
 		return void res.end(data);
 	}
 }
@@ -253,7 +241,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -56,6 +56,7 @@ export type ExtensionVirtualWorkspaceSup
+@@ -57,6 +57,7 @@ export type ExtensionVirtualWorkspaceSup
 
 export interface IProductConfiguration {
 	readonly codeServerVersion?: string
@@ -265,7 +253,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 +++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
-@@ -317,7 +317,8 @@ class LocalStorageURLCallbackProvider ex
+@@ -332,7 +332,8 @@ class LocalStorageURLCallbackProvider ex
 			this.startListening();
 		}
 
@@ -275,7 +263,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 	}
 
 	private startListening(): void {
-@@ -563,17 +564,6 @@ class WorkspaceProvider implements IWork
+@@ -579,17 +580,6 @@ class WorkspaceProvider implements IWork
 	}
 }
 
@@ -293,7 +281,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 (function () {
 
 	// Find config by checking for DOM
-@@ -582,8 +572,8 @@ function readCookie(name: string): strin
+@@ -598,8 +588,8 @@ function readCookie(name: string): strin
 	if (!configElement || !configElementAttribute) {
 		throw new Error('Missing web configuration element');
 	}
@@ -308,7 +296,7 @@ Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/ext
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/extensionResourceLoader/common/extensionResourceLoader.ts
 +++ code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/extensionResourceLoader.ts
-@@ -98,7 +98,7 @@ export abstract class AbstractExtensionR
+@@ -120,7 +120,7 @@ export abstract class AbstractExtensionR
 					: version,
 				path: 'extension'
 			}));
--- a/patches/clipboard.diff
+++ b/patches/clipboard.diff
@@ -26,7 +26,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 +++ code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
-@@ -43,7 +43,12 @@ export interface ExtensionManagementPipe
+@@ -44,7 +44,12 @@ export interface ExtensionManagementPipe
 	force?: boolean;
 }
 
@@ -40,7 +40,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 
 export interface ICommandsExecuter {
 	executeCommand<T>(id: string, ...args: any[]): Promise<T>;
-@@ -105,6 +110,9 @@ export class CLIServerBase {
+@@ -106,6 +111,9 @@ export class CLIServerBase {
 					case 'extensionManagement':
 						returnObj = await this.manageExtensions(data);
 						break;
@@ -50,7 +50,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 					default:
 						sendResponse(404, `Unknown message type: ${data.type}`);
 						break;
-@@ -172,6 +180,10 @@ export class CLIServerBase {
+@@ -173,6 +181,10 @@ export class CLIServerBase {
 		return await this._commands.executeCommand<string | undefined>('_remoteCLI.getSystemStatus');
 	}
 
@@ -78,19 +78,19 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
-@@ -119,6 +119,7 @@ export interface NativeParsedArgs {
+@@ -122,6 +122,7 @@ export interface NativeParsedArgs {
+ 	'disable-chromium-sandbox'?: boolean;
 	sandbox?: boolean;
- 
 	'enable-coi'?: boolean;
 +	'stdin-to-clipboard'?: boolean;
- 
- 	// chromium command line args: https://electronjs.org/docs/all#supported-chrome-command-line-switches
- 	'no-proxy-server'?: boolean;
+ 	'unresponsive-sample-interval'?: string;
+ 	'unresponsive-sample-period'?: string;
+ 	'enable-rdp-display-tracking'?: boolean;
 Index: code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/node/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
-@@ -90,6 +90,7 @@ export const OPTIONS: OptionDescriptions
+@@ -91,6 +91,7 @@ export const OPTIONS: OptionDescriptions
 	'user-data-dir': { type: 'string', cat: 'o', args: 'dir', description: localize('userDataDir', "Specifies the directory that user data is kept in. Can be used to open multiple distinct instances of Code.") },
 	'profile': { type: 'string', 'cat': 'o', args: 'profileName', description: localize('profileName', "Opens the provided folder or workspace with the given profile and associates the profile with the workspace. If the profile does not exist, a new empty one is created.") },
 	'help': { type: 'boolean', cat: 'o', alias: 'h', description: localize('help', "Print usage.") },
@@ -102,7 +102,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/server.cli.ts
 +++ code-server/lib/vscode/src/vs/server/node/server.cli.ts
-@@ -76,6 +76,7 @@ const isSupportedForPipe = (optionId: ke
+@@ -77,6 +77,7 @@ const isSupportedForPipe = (optionId: ke
 		case 'verbose':
 		case 'remote':
 		case 'locate-shell-integration-path':
@@ -110,7 +110,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
 			return true;
 		default:
 			return false;
-@@ -293,6 +294,22 @@ export async function main(desc: Product
+@@ -295,6 +296,22 @@ export async function main(desc: Product
 			}
 		}
 	} else {
@@ -131,5 +131,5 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
 +		}
 +
 		if (parsedArgs.status) {
- 			sendToPipe({
+ 			await sendToPipe({
 				type: 'status'
--- a/patches/disable-builtin-ext-update.diff
+++ b/patches/disable-builtin-ext-update.diff
@@ -7,7 +7,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -315,6 +315,10 @@ export class Extension implements IExten
+@@ -340,6 +340,10 @@ export class Extension implements IExten
 			if (this.type === ExtensionType.System && this.productService.quality === 'stable') {
 				return false;
 			}
--- a/patches/display-language.diff
+++ b/patches/display-language.diff
@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
 import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
 import { ConfigurationService } from '../../platform/configuration/common/configurationService.js';
-@@ -243,6 +243,9 @@ export async function setupServerService
+@@ -255,6 +255,9 @@ export async function setupServerService
 		const channel = new ExtensionManagementChannel(extensionManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority));
 		socketServer.registerChannel('extensions', channel);
 
@@ -153,31 +153,15 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -26,6 +26,7 @@ import { URI } from '../../base/common/u
+@@ -25,6 +25,7 @@ import { URI } from '../../base/common/u
 import { streamToBuffer } from '../../base/common/buffer.js';
 import { IProductConfiguration } from '../../base/common/product.js';
- import { isString } from '../../base/common/types.js';
+ import { isString, Mutable } from '../../base/common/types.js';
 +import { getLocaleFromConfig, getBrowserNLSConfiguration } from './remoteLanguagePacks.js';
 import { CharCode } from '../../base/common/charCode.js';
 import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
 import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -98,6 +99,7 @@ export class WebClientServer {
- 	private readonly _webExtensionResourceUrlTemplate: URI | undefined;
- 
- 	private readonly _staticRoute: string;
-+	private readonly _serverRoot: string;
- 	private readonly _callbackRoute: string;
- 	private readonly _webExtensionRoute: string;
- 
-@@ -113,6 +115,7 @@ export class WebClientServer {
- 	) {
- 		this._webExtensionResourceUrlTemplate = this._productService.extensionsGallery?.resourceUrlTemplate ? URI.parse(this._productService.extensionsGallery.resourceUrlTemplate) : undefined;
- 
-+		this._serverRoot = serverRootPath;
- 		this._staticRoute = `${serverRootPath}/static`;
- 		this._callbackRoute = `${serverRootPath}/callback`;
- 		this._webExtensionRoute = `/web-extension-resource`;
-@@ -351,14 +354,22 @@ export class WebClientServer {
+@@ -385,14 +386,22 @@ export class WebClientServer {
 		};
 
 		const cookies = cookie.parse(req.headers.cookie || '');
@@ -193,7 +177,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 +			try {
 +				const nlsFile = await getBrowserNLSConfiguration(locale, this._environmentService.userDataPath);
 +				WORKBENCH_NLS_URL = nlsFile
-+					? `${vscodeBase}${this._serverRoot}/vscode-remote-resource?path=${encodeURIComponent(nlsFile)}`
+					? `${vscodeBase}/vscode-remote-resource?path=${encodeURIComponent(nlsFile)}`
 +					: '';
 +			} catch (error) {
 +				console.error("Failed to generate translations", error);
@@ -214,7 +198,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
 	/* ----- server setup ----- */
 
-@@ -105,6 +106,7 @@ export interface ServerParsedArgs {
+@@ -107,6 +108,7 @@ export interface ServerParsedArgs {
 	'disable-file-downloads'?: boolean;
 	'disable-file-uploads'?: boolean;
 	'disable-getting-started-override'?: boolean,
@@ -288,7 +272,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
-@@ -433,9 +433,6 @@ export class InstallAction extends Exten
+@@ -475,9 +475,6 @@ export class InstallAction extends Exten
 		if (this.extension.isBuiltin) {
 			return;
 		}
@@ -298,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		if (this.extension.state !== ExtensionState.Uninstalled) {
 			return;
 		}
-@@ -740,7 +737,7 @@ export abstract class InstallInOtherServ
+@@ -782,7 +779,7 @@ export abstract class InstallInOtherServ
 		}
 
 		if (isLanguagePackExtension(this.extension.local.manifest)) {
@@ -307,7 +291,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		}
 
 		// Prefers to run on UI
-@@ -2001,17 +1998,6 @@ export class SetLanguageAction extends E
+@@ -2073,17 +2070,6 @@ export class SetLanguageAction extends E
 	update(): void {
 		this.enabled = false;
 		this.class = SetLanguageAction.DisabledClass;
@@ -325,7 +309,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 	}
 
 	override async run(): Promise<any> {
-@@ -2028,7 +2014,6 @@ export class ClearLanguageAction extends
+@@ -2100,7 +2086,6 @@ export class ClearLanguageAction extends
 	private static readonly DisabledClass = `${this.EnabledClass} disabled`;
 
 	constructor(
@@ -333,7 +317,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 		@ILocaleService private readonly localeService: ILocaleService,
 	) {
 		super(ClearLanguageAction.ID, ClearLanguageAction.TITLE.value, ClearLanguageAction.DisabledClass, false);
-@@ -2038,17 +2023,6 @@ export class ClearLanguageAction extends
+@@ -2110,17 +2095,6 @@ export class ClearLanguageAction extends
 	update(): void {
 		this.enabled = false;
 		this.class = ClearLanguageAction.DisabledClass;
@@ -367,7 +351,7 @@ Index: code-server/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
 +++ code-server/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
-@@ -52,7 +52,7 @@ import './services/dialogs/browser/fileD
+@@ -53,7 +53,7 @@ import './services/dialogs/browser/fileD
 import './services/host/browser/browserHostService.js';
 import './services/lifecycle/browser/lifecycleService.js';
 import './services/clipboard/browser/clipboardService.js';
--- a/patches/external-file-actions.diff
+++ b/patches/external-file-actions.diff
@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
 	/* ----- server setup ----- */
 
-@@ -99,6 +101,8 @@ export interface ServerParsedArgs {
+@@ -101,6 +103,8 @@ export interface ServerParsedArgs {
 	/* ----- code-server ----- */
 	'disable-update-check'?: boolean;
 	'auth'?: string;
@@ -112,9 +112,9 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -335,6 +335,8 @@ export class WebClientServer {
- 			serverBasePath: this._basePath,
- 			webviewEndpoint: vscodeBase + this._staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
+@@ -369,6 +369,8 @@ export class WebClientServer {
+ 			serverBasePath: basePath,
+ 			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
 			userDataPath: this._environmentService.userDataPath,
 +			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
 +			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],
@@ -126,7 +126,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
@@ -7,11 +7,11 @@ import { Event } from '../../base/common
- import { Disposable } from '../../base/common/lifecycle.js';
+ import { Disposable, DisposableStore } from '../../base/common/lifecycle.js';
 import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
 import { InputFocusedContext, IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
 -import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext } from '../common/contextkeys.js';
@@ -165,14 +165,14 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions
 +++ code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions.contribution.ts
@@ -20,7 +20,7 @@ import { CLOSE_SAVED_EDITORS_COMMAND_ID,
 import { AutoSaveAfterShortDelayContext } from '../../../services/filesConfiguration/common/filesConfigurationService.js';
- import { WorkbenchListDoubleSelection, WorkbenchTreeFindOpen } from '../../../../platform/list/browser/listService.js';
+ import { WorkbenchListDoubleSelection } from '../../../../platform/list/browser/listService.js';
 import { Schemas } from '../../../../base/common/network.js';
 -import { DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
 +import { IsEnabledFileDownloads, IsEnabledFileUploads, DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
 import { IsWebContext } from '../../../../platform/contextkey/common/contextkeys.js';
 import { ServicesAccessor } from '../../../../platform/instantiation/common/instantiation.js';
 import { ThemeIcon } from '../../../../base/common/themables.js';
-@@ -572,13 +572,16 @@ MenuRegistry.appendMenuItem(MenuId.Explo
+@@ -571,13 +571,16 @@ MenuRegistry.appendMenuItem(MenuId.Explo
 		id: DOWNLOAD_COMMAND_ID,
 		title: DOWNLOAD_LABEL
 	},
@@ -196,7 +196,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions
 	)
 }));
 
-@@ -590,6 +593,7 @@ MenuRegistry.appendMenuItem(MenuId.Explo
+@@ -589,6 +592,7 @@ MenuRegistry.appendMenuItem(MenuId.Explo
 		title: UPLOAD_LABEL,
 	},
 	when: ContextKeyExpr.and(
@@ -208,7 +208,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -40,6 +40,9 @@ export const HasWebFileSystemAccess = ne
+@@ -36,6 +36,9 @@ export const HasWebFileSystemAccess = ne
 
 export const EmbedderIdentifierContext = new RawContextKey<string | undefined>('embedderIdentifier', undefined, localize('embedderIdentifier', 'The identifier of the embedder according to the product service, if one is defined'));
 
@@ -217,7 +217,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +
 //#endregion
 
- 
+ //#region < --- Window --- >
 Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFileDialog.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFileDialog.ts
@@ -231,7 +231,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
 import { IRemoteAgentService } from '../../remote/common/remoteAgentService.js';
 import { IContextKeyService, IContextKey, RawContextKey } from '../../../../platform/contextkey/common/contextkey.js';
 import { equalsIgnoreCase, format, startsWithIgnoreCase } from '../../../../base/common/strings.js';
-@@ -139,7 +139,7 @@ export class SimpleFileDialog extends Di
+@@ -144,7 +144,7 @@ export class SimpleFileDialog extends Di
 		@IFileDialogService private readonly fileDialogService: IFileDialogService,
 		@IModelService private readonly modelService: IModelService,
 		@ILanguageService private readonly languageService: ILanguageService,
@@ -240,10 +240,10 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
 		@IRemoteAgentService private readonly remoteAgentService: IRemoteAgentService,
 		@IPathService protected readonly pathService: IPathService,
 		@IKeybindingService private readonly keybindingService: IKeybindingService,
-@@ -283,20 +283,22 @@ export class SimpleFileDialog extends Di
- 			this.filePickBox.sortByLabel = false;
+@@ -310,20 +310,22 @@ export class SimpleFileDialog extends Di
 			this.filePickBox.ignoreFocusOut = true;
 			this.filePickBox.ok = true;
+ 			this.filePickBox.okLabel = typeof this.options.openLabel === 'string' ? this.options.openLabel : this.options.openLabel?.withoutMnemonic;
 -			if ((this.scheme !== Schemas.file) && this.options && this.options.availableFileSystems && (this.options.availableFileSystems.length > 1) && (this.options.availableFileSystems.indexOf(Schemas.file) > -1)) {
 -				this.filePickBox.customButton = true;
 -				this.filePickBox.customLabel = nls.localize('remoteFileDialog.local', 'Show Local');
@@ -286,10 +286,10 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 import { mainWindow } from '../../../../../base/browser/window.js';
 import { IExplorerFileContribution, explorerFileContribRegistry } from '../explorerFileContrib.js';
 +import { IBrowserWorkbenchEnvironmentService } from '../../../../services/environment/browser/environmentService.js';
- 
- export class ExplorerDelegate implements IListVirtualDelegate<ExplorerItem> {
- 
-@@ -1030,7 +1031,8 @@ export class FileDragAndDrop implements
+ import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
+ import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
+ import { CancellationToken } from '../../../../../base/common/cancellation.js';
+@@ -1601,7 +1602,8 @@ export class FileDragAndDrop implements
 		@IConfigurationService private configurationService: IConfigurationService,
 		@IInstantiationService private instantiationService: IInstantiationService,
 		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -299,7 +299,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
 	) {
 		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
 			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1255,15 +1257,17 @@ export class FileDragAndDrop implements
+@@ -1826,15 +1828,17 @@ export class FileDragAndDrop implements
 
 			// External file DND (Import/Upload file)
 			if (data instanceof NativeDragAndDropData) {
--- a/patches/getting-started.diff
+++ b/patches/getting-started.diff
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
 import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
 import './gettingStartedColors.js';
-@@ -826,6 +826,72 @@ export class GettingStartedPage extends
+@@ -876,6 +876,72 @@ export class GettingStartedPage extends
 			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
 		);
 
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 		const leftColumn = $('.categories-column.categories-column-left', {},);
 		const rightColumn = $('.categories-column.categories-column-right', {},);
 
-@@ -861,6 +927,9 @@ export class GettingStartedPage extends
+@@ -911,6 +977,9 @@ export class GettingStartedPage extends
 				recentList.setLimit(5);
 				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
 			}
@@ -189,7 +189,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
 	/* ----- server setup ----- */
 
-@@ -103,6 +104,7 @@ export interface ServerParsedArgs {
+@@ -105,6 +106,7 @@ export interface ServerParsedArgs {
 	'auth'?: string;
 	'disable-file-downloads'?: boolean;
 	'disable-file-uploads'?: boolean;
@@ -201,7 +201,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -339,6 +339,7 @@ export class WebClientServer {
+@@ -373,6 +373,7 @@ export class WebClientServer {
 			userDataPath: this._environmentService.userDataPath,
 			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
 			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],
@@ -214,7 +214,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
@@ -7,7 +7,7 @@ import { Event } from '../../base/common
- import { Disposable } from '../../base/common/lifecycle.js';
+ import { Disposable, DisposableStore } from '../../base/common/lifecycle.js';
 import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
 import { InputFocusedContext, IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
 -import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, IsEnabledFileDownloads, IsEnabledFileUploads } from '../common/contextkeys.js';
@@ -234,7 +234,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -42,6 +42,7 @@ export const EmbedderIdentifierContext =
+@@ -38,6 +38,7 @@ export const EmbedderIdentifierContext =
 
 export const IsEnabledFileDownloads = new RawContextKey<boolean>('isEnabledFileDownloads', true, true);
 export const IsEnabledFileUploads = new RawContextKey<boolean>('isEnabledFileUploads', true, true);
--- a/patches/integration.diff
+++ b/patches/integration.diff
@@ -113,7 +113,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandl
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandler.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandler.ts
-@@ -77,8 +77,11 @@ export class BrowserDialogHandler extend
+@@ -78,8 +78,11 @@ export class BrowserDialogHandler extend
 
 	async about(): Promise<void> {
 		const detailString = (useAgo: boolean): string => {
@@ -187,10 +187,10 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 import { IndexedDB } from '../../base/browser/indexedDB.js';
 import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js';
 +import { CodeServerClient } from '../../workbench/browser/client.js';
- import { ITelemetryService } from '../../platform/telemetry/common/telemetry.js';
 import { IProgressService } from '../../platform/progress/common/progress.js';
 import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
-@@ -131,6 +132,9 @@ export class BrowserMain extends Disposa
+ import { dirname, joinPath } from '../../base/common/resources.js';
+@@ -130,6 +131,9 @@ export class BrowserMain extends Disposa
 		// Startup
 		const instantiationService = workbench.startup();
 
@@ -204,7 +204,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -55,6 +55,8 @@ export type ExtensionVirtualWorkspaceSup
+@@ -56,6 +56,8 @@ export type ExtensionVirtualWorkspaceSup
 };
 
 export interface IProductConfiguration {
@@ -269,10 +269,10 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -308,6 +308,7 @@ export class WebClientServer {
+@@ -333,6 +333,7 @@ export class WebClientServer {
 		} : undefined;
 
- 		const productConfiguration = {
+ 		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
 +			codeServerVersion: this._productService.codeServerVersion,
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
@@ -299,7 +299,7 @@ Index: code-server/lib/vscode/src/server-main.ts
 
 function sanitizeStringArg(val: any): string | undefined {
 	if (Array.isArray(val)) { // if an argument is passed multiple times, minimist creates an array
-@@ -283,3 +287,22 @@ function prompt(question: string): Promi
+@@ -286,3 +290,22 @@ function prompt(question: string): Promi
 		});
 	});
 }
--- a/patches/local-storage.diff
+++ b/patches/local-storage.diff
@@ -18,10 +18,10 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -330,6 +330,7 @@ export class WebClientServer {
+@@ -364,6 +364,7 @@ export class WebClientServer {
 			remoteAuthority,
- 			serverBasePath: this._basePath,
- 			webviewEndpoint: vscodeBase + this._staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
+ 			serverBasePath: basePath,
+ 			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
 +			userDataPath: this._environmentService.userDataPath,
 			_wrapWebWorkerExtHostInIframe,
 			developmentOptions: { enableSmokeTestDriver: this._environmentService.args['enable-smoke-test-driver'] ? true : undefined, logLevel: this._logService.getLevel() },
@@ -66,7 +66,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
-@@ -145,8 +145,10 @@ export class WorkspaceService extends Di
+@@ -147,8 +147,10 @@ export class WorkspaceService extends Di
 		this.workspaceConfiguration = this._register(new WorkspaceConfiguration(configurationCache, fileService, uriIdentityService, logService));
 		this._register(this.workspaceConfiguration.onDidUpdateConfiguration(fromCache => {
 			this.onWorkspaceConfigurationChanged(fromCache).then(() => {
@@ -79,7 +79,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
 			});
 		}));
 
-@@ -552,6 +554,12 @@ export class WorkspaceService extends Di
+@@ -555,6 +557,12 @@ export class WorkspaceService extends Di
 			previousFolders = this.workspace.folders;
 			this.workspace.update(workspace);
 		} else {
--- a/patches/logout.diff
+++ b/patches/logout.diff
@@ -8,7 +8,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -58,6 +58,7 @@ export interface IProductConfiguration {
+@@ -59,6 +59,7 @@ export interface IProductConfiguration {
 	readonly codeServerVersion?: string
 	readonly rootEndpoint?: string
 	readonly updateEndpoint?: string
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
 	/* ----- server setup ----- */
 
-@@ -97,6 +98,7 @@ export const serverOptions: OptionDescri
+@@ -99,6 +100,7 @@ export const serverOptions: OptionDescri
 export interface ServerParsedArgs {
 	/* ----- code-server ----- */
 	'disable-update-check'?: boolean;
@@ -40,14 +40,14 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -313,6 +313,7 @@ export class WebClientServer {
+@@ -341,6 +341,7 @@ export class WebClientServer {
 			codeServerVersion: this._productService.codeServerVersion,
- 			rootEndpoint: base,
- 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? base + '/update/check' : undefined,
-+			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? base + '/logout' : undefined,
+ 			rootEndpoint: rootBase,
+ 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
+			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
 Index: code-server/lib/vscode/src/vs/workbench/browser/client.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/client.ts
--- a/patches/marketplace.diff
+++ b/patches/marketplace.diff
@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -47,6 +47,16 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -49,6 +49,16 @@ else if (globalThis._VSCODE_PRODUCT_JSON
 			version: pkg.version
 		});
 	}
@@ -40,31 +40,30 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -115,7 +115,7 @@ export class WebClientServer {
+@@ -326,7 +326,6 @@ export class WebClientServer {
 
- 		this._staticRoute = `${serverRootPath}/static`;
- 		this._callbackRoute = `${serverRootPath}/callback`;
-		this._webExtensionRoute = `${serverRootPath}/web-extension-resource`;
-+		this._webExtensionRoute = `/web-extension-resource`;
- 	}
+ 		const staticRoute = posix.join(basePath, this._productPath, STATIC_PATH);
+ 		const callbackRoute = posix.join(basePath, this._productPath, CALLBACK_PATH);
+-		const webExtensionRoute = posix.join(basePath, this._productPath, WEB_EXTENSION_PATH);
 
- 	/**
-@@ -313,14 +313,7 @@ export class WebClientServer {
+ 		const resolveWorkspaceURI = (defaultLocation?: string) => defaultLocation && URI.file(resolve(defaultLocation)).with({ scheme: Schemas.vscodeRemote, authority: remoteAuthority });
+ 
+@@ -342,14 +341,7 @@ export class WebClientServer {
 			codeServerVersion: this._productService.codeServerVersion,
- 			rootEndpoint: base,
+ 			rootEndpoint: rootBase,
 			embedderIdentifier: 'server-distro',
 -			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
 -				...this._productService.extensionsGallery,
 -				resourceUrlTemplate: this._webExtensionResourceUrlTemplate.with({
 -					scheme: 'http',
 -					authority: remoteAuthority,
-					path: `${this._webExtensionRoute}/${this._webExtensionResourceUrlTemplate.authority}${this._webExtensionResourceUrlTemplate.path}`
+-					path: `${webExtensionRoute}/${this._webExtensionResourceUrlTemplate.authority}${this._webExtensionResourceUrlTemplate.path}`
 -				}).toString(true)
 -			} : undefined
 +			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
 
- 		if (!this._environmentService.isBuilt) {
+ 		const proposedApi = this._environmentService.args['enable-proposed-api'];
 Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/extensionResourceLoader.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/extensionResourceLoader/common/extensionResourceLoader.ts
@@ -75,9 +74,9 @@ Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/ext
 import { getTelemetryLevel, supportsTelemetry } from '../../telemetry/common/telemetryUtils.js';
 -import { RemoteAuthorities } from '../../../base/common/network.js';
 import { TargetPlatform } from '../../extensions/common/extensions.js';
- 
- const WEB_EXTENSION_RESOURCE_END_POINT_SEGMENT = '/web-extension-resource/';
-@@ -140,9 +139,9 @@ export abstract class AbstractExtensionR
+ import { ExtensionGalleryResourceType, getExtensionGalleryManifestResourceUri, IExtensionGalleryManifest, IExtensionGalleryManifestService } from '../../extensionManagement/common/extensionGalleryManifest.js';
+ import { ILogService } from '../../log/common/log.js';
+@@ -163,9 +162,9 @@ export abstract class AbstractExtensionR
 	}
 
 	protected _isWebExtensionResourceEndPoint(uri: URI): boolean {
--- a/patches/proposed-api.diff
+++ b/patches/proposed-api.diff
@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/common/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
-@@ -313,10 +313,7 @@ function extensionDescriptionArrayToMap(
+@@ -314,10 +314,7 @@ function extensionDescriptionArrayToMap(
 }
 
 export function isProposedApiEnabled(extension: IExtensionDescription, proposal: ApiProposalName): boolean {
--- a/patches/proxy-uri.diff
+++ b/patches/proxy-uri.diff
@@ -30,7 +30,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -59,6 +59,7 @@ export interface IProductConfiguration {
+@@ -60,6 +60,7 @@ export interface IProductConfiguration {
 	readonly rootEndpoint?: string
 	readonly updateEndpoint?: string
 	readonly logoutEndpoint?: string
@@ -71,14 +71,14 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -314,6 +314,7 @@ export class WebClientServer {
- 			rootEndpoint: base,
- 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? base + '/update/check' : undefined,
- 			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? base + '/logout' : undefined,
-+			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? base + '/proxy/{{port}}/',
+@@ -342,6 +342,7 @@ export class WebClientServer {
+ 			rootEndpoint: rootBase,
+ 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
+ 			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
+			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? rootBase + '/proxy/{{port}}/',
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
 Index: code-server/lib/vscode/src/vs/workbench/contrib/terminal/common/terminalEnvironment.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/terminal/common/terminalEnvironment.ts
@@ -104,7 +104,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 import type { IURLCallbackProvider } from '../../../workbench/services/url/browser/urlService.js';
 import { create } from '../../../workbench/workbench.web.main.internal.js';
 
-@@ -584,6 +585,39 @@ class WorkspaceProvider implements IWork
+@@ -600,6 +601,39 @@ class WorkspaceProvider implements IWork
 		settingsSyncOptions: config.settingsSyncOptions ? { enabled: config.settingsSyncOptions.enabled, } : undefined,
 		workspaceProvider: WorkspaceProvider.create(config),
 		urlCallbackProvider: new LocalStorageURLCallbackProvider(config.callbackRoute),
@@ -148,7 +148,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExpl
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/remote/browser/remoteExplorer.ts
-@@ -77,8 +77,8 @@ export class ForwardedPortsView extends
+@@ -83,8 +83,8 @@ export class ForwardedPortsView extends
 	private async enableForwardedPortsFeatures() {
 		this.contextKeyListener.clear();
 
--- a/patches/series
+++ b/patches/series
@@ -20,3 +20,5 @@ getting-started.diff
 keepalive.diff
 clipboard.diff
 display-language.diff
+trusted-domains.diff
+signature-verification.diff
--- a/patches/service-worker.diff
+++ b/patches/service-worker.diff
@@ -6,7 +6,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -60,6 +60,10 @@ export interface IProductConfiguration {
+@@ -61,6 +61,10 @@ export interface IProductConfiguration {
 	readonly updateEndpoint?: string
 	readonly logoutEndpoint?: string
 	readonly proxyEndpointTemplate?: string
@@ -54,14 +54,14 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -315,6 +315,10 @@ export class WebClientServer {
- 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? base + '/update/check' : undefined,
- 			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? base + '/logout' : undefined,
- 			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? base + '/proxy/{{port}}/',
+@@ -343,6 +343,10 @@ export class WebClientServer {
+ 			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
+ 			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
+ 			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? rootBase + '/proxy/{{port}}/',
 +			serviceWorker: {
 +				scope: vscodeBase + '/',
-+				path: base + '/_static/out/browser/serviceWorker.js',
+				path: rootBase + '/_static/out/browser/serviceWorker.js',
 +			},
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
--- a/patches/signature-verification.diff
+++ b/patches/signature-verification.diff
@@ -0,0 +1,34 @@
+Disable signature verification.
+
+Extension signature verification is now mandatory for all platforms and needs to be disabled.
+
+Index: code-server/lib/vscode/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+++ code-server/lib/vscode/src/vs/platform/extensionManagement/node/extensionManagementService.ts
+@@ -34,6 +34,7 @@ import {
+ 	ExtensionSignatureVerificationCode,
+ 	computeSize,
+ 	IAllowedExtensionsService,
+	// @ts-expect-error no-unused-variable
+ 	VerifyExtensionSignatureConfigKey,
+ 	shouldRequireRepositorySignatureFor,
+ } from '../common/extensionManagement.js';
+@@ -87,6 +88,7 @@ export class ExtensionManagementService
+ 		@IDownloadService private downloadService: IDownloadService,
+ 		@IInstantiationService private readonly instantiationService: IInstantiationService,
+ 		@IFileService private readonly fileService: IFileService,
+		// @ts-expect-error no-unused-variable
+ 		@IConfigurationService private readonly configurationService: IConfigurationService,
+ 		@IExtensionGalleryManifestService protected readonly extensionGalleryManifestService: IExtensionGalleryManifestService,
+ 		@IProductService productService: IProductService,
+@@ -339,8 +341,7 @@ export class ExtensionManagementService
+ 
+ 	private async downloadExtension(extension: IGalleryExtension, operation: InstallOperation, verifySignature: boolean, clientTargetPlatform?: TargetPlatform): Promise<{ readonly location: URI; readonly verificationStatus: ExtensionSignatureVerificationCode | undefined }> {
+ 		if (verifySignature) {
+-			const value = this.configurationService.getValue(VerifyExtensionSignatureConfigKey);
+-			verifySignature = isBoolean(value) ? value : true;
+			verifySignature = false;
+ 		}
+ 		const { location, verificationStatus } = await this.extensionsDownloader.download(extension, operation, verifySignature, clientTargetPlatform);
+ 		const shouldRequireSignature = shouldRequireRepositorySignatureFor(extension.private, await this.extensionGalleryManifestService.getExtensionGalleryManifest());
--- a/patches/sourcemaps.diff
+++ b/patches/sourcemaps.diff
@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/build/gulpfile.reh.js
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.reh.js
 +++ code-server/lib/vscode/build/gulpfile.reh.js
-@@ -253,8 +253,7 @@ function packageTask(type, platform, arc
+@@ -256,8 +256,7 @@ function packageTask(type, platform, arc
 
 		const src = gulp.src(sourceFolderName + '/**', { base: '.' })
 			.pipe(rename(function (path) { path.dirname = path.dirname.replace(new RegExp('^' + sourceFolderName), 'out'); }))
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/build/gulpfile.reh.js
 
 		const workspaceExtensionPoints = ['debuggers', 'jsonValidation'];
 		const isUIExtension = (manifest) => {
-@@ -293,9 +292,9 @@ function packageTask(type, platform, arc
+@@ -296,9 +295,9 @@ function packageTask(type, platform, arc
 			.map(name => `.build/extensions/${name}/**`);
 
 		const extensions = gulp.src(extensionPaths, { base: '.build', dot: true });
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/build/gulpfile.reh.js
 
 		let version = packageJson.version;
 		const quality = product.quality;
-@@ -454,7 +453,7 @@ function tweakProductForServerWeb(produc
+@@ -451,7 +450,7 @@ function tweakProductForServerWeb(produc
 	const minifyTask = task.define(`minify-vscode-${type}`, task.series(
 		bundleTask,
 		util.rimraf(`out-vscode-${type}-min`),
--- a/patches/store-socket.diff
+++ b/patches/store-socket.diff
@@ -21,18 +21,18 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostExtensionService.
 
 +import * as _http from 'http';
 import * as performance from '../../../base/common/performance.js';
+ import type * as vscode from 'vscode';
 import { createApiFactoryAndRegisterActors } from '../common/extHost.api.impl.js';
- import { RequireInterceptor } from '../common/extHostRequireInterceptor.js';
-@@ -17,6 +18,7 @@ import { ExtensionRuntime } from '../com
+@@ -18,6 +19,7 @@ import { ExtensionRuntime } from '../com
 import { CLIServer } from './extHostCLIServer.js';
 import { realpathSync } from '../../../base/node/extpath.js';
 import { ExtHostConsoleForwarder } from './extHostConsoleForwarder.js';
 +import { IExtHostWorkspace } from '../common/extHostWorkspace.js';
 import { ExtHostDiskFileSystemProvider } from './extHostDiskFileSystemProvider.js';
- import { createRequire } from 'node:module';
- const require = createRequire(import.meta.url);
-@@ -97,6 +99,52 @@ export class ExtHostExtensionService ext
- 		await interceptor.install();
+ import nodeModule from 'node:module';
+ import { assertType } from '../../../base/common/types.js';
+@@ -226,6 +228,52 @@ export class ExtHostExtensionService ext
+ 
 		performance.mark('code/extHost/didInitAPI');
 
 +		(async () => {
@@ -96,7 +96,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extensionHostProcess.ts
 import minimist from 'minimist';
 import * as nativeWatchdog from 'native-watchdog';
 import * as net from 'net';
-@@ -422,7 +423,28 @@ async function startExtensionHostProcess
+@@ -437,7 +438,28 @@ async function startExtensionHostProcess
 	);
 
 	// rewrite onTerminate-function to be a proper shutdown
--- a/patches/telemetry.diff
+++ b/patches/telemetry.diff
@@ -28,8 +28,8 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 import { NullPolicyService } from '../../platform/policy/common/policy.js';
 import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
 import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -151,11 +153,23 @@ export async function setupServerService
- 	const requestService = new RequestService(configurationService, environmentService, logService);
+@@ -158,11 +160,23 @@ export async function setupServerService
+ 	const requestService = new RequestService('remote', configurationService, environmentService, logService);
 	services.set(IRequestService, requestService);
 
 +	let isContainer = undefined;
@@ -134,20 +134,20 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -319,6 +319,8 @@ export class WebClientServer {
+@@ -347,6 +347,8 @@ export class WebClientServer {
 				scope: vscodeBase + '/',
- 				path: base + '/_static/out/browser/serviceWorker.js',
+ 				path: rootBase + '/_static/out/browser/serviceWorker.js',
 			},
 +			enableTelemetry: this._productService.enableTelemetry,
 +			telemetryEndpoint: this._productService.telemetryEndpoint,
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
 Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -64,6 +64,7 @@ export interface IProductConfiguration {
+@@ -65,6 +65,7 @@ export interface IProductConfiguration {
 		readonly path: string;
 		readonly scope: string;
 	}
@@ -159,7 +159,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -55,7 +55,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -57,7 +57,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
 			resourceUrlTemplate: "https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}",
 			controlUrl: "",
 			recommendationsUrl: "",
--- a/patches/trusted-domains.diff
+++ b/patches/trusted-domains.diff
@@ -0,0 +1,49 @@
+Allow configuring trusted domains via product.json or flag.
+
+Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
+++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
+@@ -20,6 +20,7 @@ export const serverOptions: OptionDescri
+ 	'disable-file-uploads': { type: 'boolean' },
+ 	'disable-getting-started-override': { type: 'boolean' },
+ 	'locale': { type: 'string' },
+	'link-protection-trusted-domains': { type: 'string[]' },
+ 
+ 	/* ----- server setup ----- */
+ 
+@@ -109,6 +110,7 @@ export interface ServerParsedArgs {
+ 	'disable-file-uploads'?: boolean;
+ 	'disable-getting-started-override'?: boolean,
+ 	'locale'?: string
+	'link-protection-trusted-domains'?: string[],
+ 
+ 	/* ----- server setup ----- */
+ 
+Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
+++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+@@ -338,6 +338,14 @@ export class WebClientServer {
+ 			scopes: [['user:email'], ['repo']]
+ 		} : undefined;
+ 
+		const linkProtectionTrustedDomains: string[] = [];
+		if (this._environmentService.args['link-protection-trusted-domains']) {
+			linkProtectionTrustedDomains.push(...this._environmentService.args['link-protection-trusted-domains']);
+		}
+		if (this._productService.linkProtectionTrustedDomains) {
+			linkProtectionTrustedDomains.push(...this._productService.linkProtectionTrustedDomains);
+		}
+
+ 		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
+ 			codeServerVersion: this._productService.codeServerVersion,
+ 			rootEndpoint: rootBase,
+@@ -352,6 +360,7 @@ export class WebClientServer {
+ 			telemetryEndpoint: this._productService.telemetryEndpoint,
+ 			embedderIdentifier: 'server-distro',
+ 			extensionsGallery: this._productService.extensionsGallery,
+			linkProtectionTrustedDomains,
+ 		};
+ 
+ 		const proposedApi = this._environmentService.args['enable-proposed-api'];
--- a/patches/unique-db.diff
+++ b/patches/unique-db.diff
@@ -21,7 +21,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/storage/browser/storageS
 
 export class BrowserStorageService extends AbstractStorageService {
 
-@@ -298,7 +299,11 @@ export class IndexedDBStorageDatabase ex
+@@ -300,7 +301,11 @@ export class IndexedDBStorageDatabase ex
 	}
 
 	static async createWorkspaceStorage(workspaceId: string, logService: ILogService): Promise<IIndexedDBStorageDatabase> {
--- a/patches/update-check.diff
+++ b/patches/update-check.diff
@@ -93,7 +93,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -57,6 +57,7 @@ export type ExtensionVirtualWorkspaceSup
+@@ -58,6 +58,7 @@ export type ExtensionVirtualWorkspaceSup
 export interface IProductConfiguration {
 	readonly codeServerVersion?: string
 	readonly rootEndpoint?: string
@@ -105,14 +105,14 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -312,6 +312,7 @@ export class WebClientServer {
- 		const productConfiguration = {
+@@ -340,6 +340,7 @@ export class WebClientServer {
+ 		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
 			codeServerVersion: this._productService.codeServerVersion,
- 			rootEndpoint: base,
-+			updateEndpoint: !this._environmentService.args['disable-update-check'] ? base + '/update/check' : undefined,
+ 			rootEndpoint: rootBase,
+			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
 			embedderIdentifier: 'server-distro',
 			extensionsGallery: this._productService.extensionsGallery,
- 		} satisfies Partial<IProductConfiguration>;
+ 		};
 Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
@@ -126,7 +126,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
 	/* ----- server setup ----- */
 
-@@ -93,6 +95,8 @@ export const serverOptions: OptionDescri
+@@ -95,6 +97,8 @@ export const serverOptions: OptionDescri
 };
 
 export interface ServerParsedArgs {
--- a/patches/webview.diff
+++ b/patches/webview.diff
@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -225,7 +225,7 @@ export class BrowserWorkbenchEnvironment
+@@ -220,7 +220,7 @@ export class BrowserWorkbenchEnvironment
 
 	@memoize
 	get webviewExternalEndpoint(): string {
@@ -54,11 +54,11 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -326,6 +326,7 @@ export class WebClientServer {
+@@ -360,6 +360,7 @@ export class WebClientServer {
 		const workbenchWebConfiguration = {
 			remoteAuthority,
- 			serverBasePath: this._basePath,
-+			webviewEndpoint: vscodeBase + this._staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
+ 			serverBasePath: basePath,
+			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
 			_wrapWebWorkerExtHostInIframe,
 			developmentOptions: { enableSmokeTestDriver: this._environmentService.args['enable-smoke-test-driver'] ? true : undefined, logLevel: this._logService.getLevel() },
 			settingsSyncOptions: !this._environmentService.isBuilt && this._environmentService.args['enable-sync'] ? { enabled: true } : undefined,
@@ -70,29 +70,12 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
 	<meta charset="UTF-8">
 
 	<meta http-equiv="Content-Security-Policy"
-		content="default-src 'none'; script-src 'sha256-DXeP32g8BdMsVuVabYTmznoTH59F7M7UtV0vXemEFqc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-z5v/0xE4zQPgV1fazhHB/UlsTzdm39hRMk3V8Av0HI4=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
- 
+-		content="default-src 'none'; script-src 'sha256-gEAyFzmkyqMoTTnN+3KReFUYoHsK4RAJEb+6eiul+UY=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+		content="default-src 'none'; script-src 'sha256-1qYtPnTQa4VwKNJO61EOhs2agF9TvuQSYIJ27OgzZqI=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
 
 	<!-- Disable pinch zooming -->
-@@ -349,6 +349,12 @@
- 
- 				const hostname = location.hostname;
- 
-+				// It is safe to run if we are on the same host.
-+				const parent = new URL(parentOrigin)
-+				if (parent.hostname === hostname) {
-+					return start(parentOrigin)
-+				}
-+
- 				if (!crypto.subtle) {
- 					// cannot validate, not running in a secure context
- 					throw new Error(`'crypto.subtle' is not available so webviews will not work. This is likely because the editor is not running in a secure context (https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts).`);
-Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
-===================================================================
--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
-+++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index-no-csp.html
-@@ -343,6 +343,12 @@
+ 	<meta name="viewport"
+@@ -351,6 +351,12 @@
 
 				const hostname = location.hostname;
 
@@ -113,12 +96,12 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWor
 		<meta http-equiv="Content-Security-Policy" content="
 			default-src 'none';
 			child-src 'self' data: blob:;
-			script-src 'self' 'unsafe-eval' 'sha256-xM2KVDKIoeb8vVxk4ezEUsxdTZh5wFnKO3YmFhy9tkk=' https: http://localhost:* blob:;
-+			script-src 'self' 'unsafe-eval' 'sha256-6eZXxikxkENULU0EOkVQSd4hglGixLg3Aow9psZ6u2Y=' https: http://localhost:* blob:;
+-			script-src 'self' 'unsafe-eval' 'sha256-cl8ijlOzEe+0GRCQNJQu2k6nUQ0fAYNYIuuKEm72JDs=' https: http://localhost:* blob:;
+			script-src 'self' 'unsafe-eval' 'sha256-yhZXuB8LS6t73dvNg6rtLX8y4PHLnqRm5+6DdOGkOcw=' https: http://localhost:* blob:;
 			connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
 	</head>
 	<body>
-@@ -23,6 +23,13 @@
+@@ -25,6 +25,13 @@
 			// validation not requested
 			return start();
 		}
--- a/src/browser/pages/error.css
+++ b/src/browser/pages/error.css
@@ -11,6 +11,7 @@

 .error-display > .body {
  color: #444;
+  color: light-dark(#444, #ccc);
  font-size: 1.2rem;
 }

--- a/src/browser/pages/error.html
+++ b/src/browser/pages/error.html
@@ -10,7 +10,7 @@
      http-equiv="Content-Security-Policy"
      content="style-src 'self'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
    />
-
+    <meta name="color-scheme" content="light dark" />
    <title>{{ERROR_TITLE}} - code-server</title>
    <link rel="icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon-dark-support.svg" />
    <link rel="alternate icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon.ico" />
--- a/src/browser/pages/global.css
+++ b/src/browser/pages/global.css
@@ -1,3 +1,7 @@
+:root {
+  color-scheme: light dark;
+}
+
 html,
 body,
 #root {
@@ -7,7 +11,9 @@ body,

 body {
  background: rgb(244, 247, 252);
+  background: light-dark(rgb(244, 247, 252), #111827);
  color: #111;
+  color: light-dark(#111, #ddd);
  margin: 0;
  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji",
    "Segoe UI Emoji", "Segoe UI Symbol";
@@ -23,12 +29,15 @@ button {

 .-button {
  background-color: rgb(87, 114, 245);
+  background-color: light-dark(rgb(87, 114, 245), rgb(26, 86, 219));
  border-radius: 5px;
  border: none;
  box-sizing: border-box;
  color: white;
+  color: light-dark(white, white);
  cursor: pointer;
  padding: 18px 20px;
+  font-weight: 500;
  text-decoration: none;
 }

@@ -45,9 +54,10 @@ button {

 .card-box {
  background-color: rgb(250, 253, 258);
+  background-color: light-dark(rgb(250, 253, 258), #1f2937);
  border-radius: 5px;
  box-shadow:
-    rgba(60, 66, 87, 0.117647) 0px 7px 14px 0px,
+    light-dark(rgba(60, 66, 87, 0.117647), rgba(10, 10, 10, 0.617647)) 0px 7px 14px 0px,
    rgba(0, 0, 0, 0.117647) 0px 3px 6px 0px;
  max-width: 650px;
  width: 100%;
@@ -55,7 +65,9 @@ button {

 .card-box > .header {
  border-bottom: 1px solid #ddd;
+  border-bottom: 1px solid light-dark(#ddd, #111827);
  color: #444;
+  color: light-dark(#444, #fff);
  padding: 30px;
 }

@@ -66,6 +78,7 @@ button {

 .card-box > .header > .sub {
  color: #555;
+  color: light-dark(#555, #9ca3af);
  margin-top: 10px;
 }

--- a/src/browser/pages/login.css
+++ b/src/browser/pages/login.css
@@ -30,14 +30,23 @@ body {

 .login-form > .field > .password {
  background-color: rgb(244, 247, 252);
+  background-color: light-dark(rgb(244, 247, 252), #374151);
  border-radius: 5px;
  border: 1px solid #ddd;
+  border: 1px solid light-dark(#ddd, #4b5563);
  box-sizing: border-box;
-  color: black;
  flex: 1;
  padding: 16px;
 }

+.login-form > .field > .password::placeholder {
+  color: rgb(148 163 184);
+}
+
+.login-form > .field > .password:focus {
+  outline: 2px solid rgb(63, 131, 248);
+}
+
 .login-form > .user {
  display: none;
 }
--- a/src/browser/pages/login.html
+++ b/src/browser/pages/login.html
@@ -10,6 +10,7 @@
      http-equiv="Content-Security-Policy"
      content="style-src 'self'; script-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
    />
+    <meta name="color-scheme" content="light dark" />
    <title>{{I18N_LOGIN_TITLE}}</title>
    <link rel="icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon-dark-support.svg" />
    <link rel="alternate icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon.ico" />
--- a/src/node/cli.ts
+++ b/src/node/cli.ts
@@ -30,7 +30,7 @@ export enum LogLevel {
 export class OptionalString extends Optional<string> {}

 /**
- * Code flags provided by the user.
+ * (VS) Code flags provided by the user.
 */
 export interface UserProvidedCodeArgs {
  "disable-telemetry"?: boolean
@@ -53,7 +53,9 @@ export interface UserProvidedCodeArgs {
  "disable-getting-started-override"?: boolean
  "disable-proxy"?: boolean
  "session-socket"?: string
-  "abs-proxy-base-path"?: string
+  "link-protection-trusted-domains"?: string[]
+  // locale is used by both VS Code and code-server.
+  locale?: string
 }

 /**
@@ -73,7 +75,6 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
  enable?: string[]
  help?: boolean
  host?: string
-  locale?: string
  port?: number
  json?: boolean
  log?: LogLevel
@@ -84,12 +85,14 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
  "trusted-origins"?: string[]
  version?: boolean
  "proxy-domain"?: string[]
+  "skip-auth-preflight"?: boolean
  "reuse-window"?: boolean
  "new-window"?: boolean
  "ignore-last-opened"?: boolean
  verbose?: boolean
  "app-name"?: string
  "welcome-text"?: string
+  "abs-proxy-base-path"?: string
  /* Positional arguments. */
  _?: string[]
 }
@@ -118,18 +121,18 @@ interface Option<T> {
 type OptionType<T> = T extends boolean
  ? "boolean"
  : T extends OptionalString
-  ? typeof OptionalString
-  : T extends LogLevel
-  ? typeof LogLevel
-  : T extends AuthType
-  ? typeof AuthType
-  : T extends number
-  ? "number"
-  : T extends string
-  ? "string"
-  : T extends string[]
-  ? "string[]"
-  : "unknown"
+    ? typeof OptionalString
+    : T extends LogLevel
+      ? typeof LogLevel
+      : T extends AuthType
+        ? typeof AuthType
+        : T extends number
+          ? "number"
+          : T extends string
+            ? "string"
+            : T extends string[]
+              ? "string[]"
+              : "unknown"

 export type Options<T> = {
  [P in keyof T]: Option<OptionType<T[P]>>
@@ -193,6 +196,10 @@ export const options: Options<Required<UserProvidedArgs>> = {
  enable: { type: "string[]" },
  help: { type: "boolean", short: "h", description: "Show this output." },
  json: { type: "boolean" },
+  "link-protection-trusted-domains": {
+    type: "string[]",
+    description: "Links matching a trusted domain can be opened without link protection.",
+  },
  locale: {
    // The preferred way to set the locale is via the UI.
    type: "string",
@@ -252,6 +259,10 @@ export const options: Options<Required<UserProvidedArgs>> = {
    description: "GitHub authentication token (can only be passed in via $GITHUB_TOKEN or the config file).",
  },
  "proxy-domain": { type: "string[]", description: "Domain used for proxying ports." },
+  "skip-auth-preflight": {
+    type: "boolean",
+    description: "Allows preflight requests through proxy without authentication.",
+  },
  "ignore-last-opened": {
    type: "boolean",
    short: "e",
@@ -702,12 +713,16 @@ export function parseConfigFile(configFile: string, configPath: string): ConfigA

  // We convert the config file into a set of flags.
  // This is a temporary measure until we add a proper CLI library.
-  const configFileArgv = Object.entries(config).map(([optName, opt]) => {
-    if (opt === true) {
-      return `--${optName}`
-    }
-    return `--${optName}=${opt}`
-  })
+  const configFileArgv = Object.entries(config)
+    .map(([optName, opt]) => {
+      if (opt === true) {
+        return `--${optName}`
+      } else if (Array.isArray(opt)) {
+        return opt.map((o) => `--${optName}=${o}`)
+      }
+      return `--${optName}=${opt}`
+    })
+    .flat()
  const args = parse(configFileArgv, {
    configFile: configPath,
  })
--- a/src/node/main.ts
+++ b/src/node/main.ts
@@ -1,5 +1,6 @@
 import { field, logger } from "@coder/logger"
 import http from "http"
+import * as os from "os"
 import * as path from "path"
 import { Disposable } from "../common/emitter"
 import { plural } from "../common/util"
@@ -51,7 +52,11 @@ export const runCodeCli = async (args: DefaultedArgs): Promise<void> => {
  try {
    // See vscode.loadVSCode for more on this jank.
    process.env.CODE_SERVER_PARENT_PID = process.pid.toString()
-    const modPath = path.join(vsRootPath, "out/server-main.js")
+    let modPath = path.join(vsRootPath, "out/server-main.js")
+    if (os.platform() === "win32") {
+      // On Windows, absolute paths of ESM modules must be a valid file URI.
+      modPath = "file:///" + modPath.replace(/\\/g, "/")
+    }
    const mod = (await eval(`import("${modPath}")`)) as VSCodeModule
    const serverModule = await mod.loadCodeWithNls()
    await serverModule.spawnCli(await toCodeArgs(args))
@@ -158,6 +163,9 @@ export const runCodeServer = async (
    logger.info(`  - ${plural(args["proxy-domain"].length, "Proxying the following domain")}:`)
    args["proxy-domain"].forEach((domain) => logger.info(`    - ${domain}`))
  }
+  if (args["skip-auth-preflight"]) {
+    logger.info("  - Skipping authentication for preflight requests")
+  }
  if (process.env.VSCODE_PROXY_URI) {
    logger.info(`Using proxy URI in PORTS tab: ${process.env.VSCODE_PROXY_URI}`)
  }
--- a/src/node/plugin.ts
+++ b/src/node/plugin.ts
@@ -1,302 +0,0 @@
-import { field, Level, Logger } from "@coder/logger"
-import * as express from "express"
-import * as fs from "fs"
-import * as path from "path"
-import * as semver from "semver"
-import * as pluginapi from "../../typings/pluginapi"
-import { HttpCode, HttpError } from "../common/http"
-import { version } from "./constants"
-import { authenticated, ensureAuthenticated, replaceTemplates } from "./http"
-import { proxy } from "./proxy"
-import * as util from "./util"
-import { Router as WsRouter, WebsocketRouter, wss } from "./wsRouter"
-const fsp = fs.promises
-
-// Represents a required module which could be anything.
-type Module = any
-
-/**
- * Inject code-server when `require`d. This is required because the API provides
- * more than just types so these need to be provided at run-time.
- */
-const originalLoad = require("module")._load
-require("module")._load = function (request: string, parent: object, isMain: boolean): Module {
-  return request === "code-server" ? codeServer : originalLoad.apply(this, [request, parent, isMain])
-}
-
-/**
- * The module you get when importing "code-server".
- */
-export const codeServer = {
-  HttpCode,
-  HttpError,
-  Level,
-  authenticated,
-  ensureAuthenticated,
-  express,
-  field,
-  proxy,
-  replaceTemplates,
-  WsRouter,
-  wss,
-}
-
-interface Plugin extends pluginapi.Plugin {
-  /**
-   * These fields are populated from the plugin's package.json
-   * and now guaranteed to exist.
-   */
-  name: string
-  version: string
-
-  /**
-   * path to the node module on the disk.
-   */
-  modulePath: string
-}
-
-interface Application extends pluginapi.Application {
-  /*
-   * Clone of the above without functions.
-   */
-  plugin: Omit<Plugin, "init" | "deinit" | "router" | "applications">
-}
-
-/**
- * PluginAPI implements the plugin API described in typings/pluginapi.d.ts
- * Please see that file for details.
- */
-export class PluginAPI {
-  private readonly plugins = new Map<string, Plugin>()
-  private readonly logger: Logger
-
-  public constructor(
-    logger: Logger,
-    /**
-     * These correspond to $CS_PLUGIN_PATH and $CS_PLUGIN respectively.
-     */
-    private readonly csPlugin = "",
-    private readonly csPluginPath = `${path.join(util.paths.data, "plugins")}:/usr/share/code-server/plugins`,
-    private readonly workingDirectory: string | undefined = undefined,
-  ) {
-    this.logger = logger.named("pluginapi")
-  }
-
-  /**
-   * applications grabs the full list of applications from
-   * all loaded plugins.
-   */
-  public async applications(): Promise<Application[]> {
-    const apps = new Array<Application>()
-    for (const [, p] of this.plugins) {
-      if (!p.applications) {
-        continue
-      }
-      const pluginApps = await p.applications()
-
-      // Add plugin key to each app.
-      apps.push(
-        ...pluginApps.map((app) => {
-          app = { ...app, path: path.join(p.routerPath, app.path || "") }
-          app = { ...app, iconPath: path.join(app.path || "", app.iconPath) }
-          return {
-            ...app,
-            plugin: {
-              name: p.name,
-              version: p.version,
-              modulePath: p.modulePath,
-
-              displayName: p.displayName,
-              description: p.description,
-              routerPath: p.routerPath,
-              homepageURL: p.homepageURL,
-            },
-          }
-        }),
-      )
-    }
-    return apps
-  }
-
-  /**
-   * mount mounts all plugin routers onto r and websocket routers onto wr.
-   */
-  public mount(r: express.Router, wr: express.Router): void {
-    for (const [, p] of this.plugins) {
-      if (p.router) {
-        r.use(`${p.routerPath}`, p.router())
-      }
-      if (p.wsRouter) {
-        wr.use(`${p.routerPath}`, (p.wsRouter() as WebsocketRouter).router)
-      }
-    }
-  }
-
-  /**
-   * loadPlugins loads all plugins based on this.csPlugin,
-   * this.csPluginPath and the built in plugins.
-   */
-  public async loadPlugins(loadBuiltin = true): Promise<void> {
-    for (const dir of this.csPlugin.split(":")) {
-      if (!dir) {
-        continue
-      }
-      await this.loadPlugin(dir)
-    }
-
-    for (const dir of this.csPluginPath.split(":")) {
-      if (!dir) {
-        continue
-      }
-      await this._loadPlugins(dir)
-    }
-
-    if (loadBuiltin) {
-      await this._loadPlugins(path.join(__dirname, "../../plugins"))
-    }
-  }
-
-  /**
-   * _loadPlugins is the counterpart to loadPlugins.
-   *
-   * It differs in that it loads all plugins in a single
-   * directory whereas loadPlugins uses all available directories
-   * as documented.
-   */
-  private async _loadPlugins(dir: string): Promise<void> {
-    try {
-      const entries = await fsp.readdir(dir, { withFileTypes: true })
-      for (const ent of entries) {
-        if (!ent.isDirectory()) {
-          continue
-        }
-        await this.loadPlugin(path.join(dir, ent.name))
-      }
-    } catch (error: any) {
-      if (error.code !== "ENOENT") {
-        this.logger.warn(`failed to load plugins from ${q(dir)}: ${error.message}`)
-      }
-    }
-  }
-
-  private async loadPlugin(dir: string): Promise<void> {
-    try {
-      const str = await fsp.readFile(path.join(dir, "package.json"), {
-        encoding: "utf8",
-      })
-      const packageJSON: PackageJSON = JSON.parse(str)
-      for (const [, p] of this.plugins) {
-        if (p.name === packageJSON.name) {
-          this.logger.warn(
-            `ignoring duplicate plugin ${q(p.name)} at ${q(dir)}, using previously loaded ${q(p.modulePath)}`,
-          )
-          return
-        }
-      }
-      const p = this._loadPlugin(dir, packageJSON)
-      this.plugins.set(p.name, p)
-    } catch (error: any) {
-      if (error.code !== "ENOENT") {
-        this.logger.warn(`failed to load plugin: ${error.stack}`)
-      }
-    }
-  }
-
-  /**
-   * _loadPlugin is the counterpart to loadPlugin and actually
-   * loads the plugin now that we know there is no duplicate
-   * and that the package.json has been read.
-   */
-  private _loadPlugin(dir: string, packageJSON: PackageJSON): Plugin {
-    dir = path.resolve(dir)
-
-    const logger = this.logger.named(packageJSON.name)
-    logger.debug("loading plugin", field("plugin_dir", dir), field("package_json", packageJSON))
-
-    if (!packageJSON.name) {
-      throw new Error("plugin package.json missing name")
-    }
-    if (!packageJSON.version) {
-      throw new Error("plugin package.json missing version")
-    }
-    if (!packageJSON.engines || !packageJSON.engines["code-server"]) {
-      throw new Error(`plugin package.json missing code-server range like:
-  "engines": {
-    "code-server": "^3.7.0"
-   }
-`)
-    }
-    if (!semver.satisfies(version, packageJSON.engines["code-server"])) {
-      this.logger.warn(
-        `plugin range ${q(packageJSON.engines["code-server"])} incompatible` + ` with code-server version ${version}`,
-      )
-    }
-
-    const pluginModule = require(dir)
-    if (!pluginModule.plugin) {
-      throw new Error("plugin module does not export a plugin")
-    }
-
-    const p = {
-      name: packageJSON.name,
-      version: packageJSON.version,
-      modulePath: dir,
-      ...pluginModule.plugin,
-    } as Plugin
-
-    if (!p.displayName) {
-      throw new Error("plugin missing displayName")
-    }
-    if (!p.description) {
-      throw new Error("plugin missing description")
-    }
-    if (!p.routerPath) {
-      throw new Error("plugin missing router path")
-    }
-    if (!p.routerPath.startsWith("/")) {
-      throw new Error(`plugin router path ${q(p.routerPath)}: invalid`)
-    }
-    if (!p.homepageURL) {
-      throw new Error("plugin missing homepage")
-    }
-
-    p.init({
-      logger: logger,
-      workingDirectory: this.workingDirectory,
-    })
-
-    logger.debug("loaded")
-
-    return p
-  }
-
-  public async dispose(): Promise<void> {
-    await Promise.all(
-      Array.from(this.plugins.values()).map(async (p) => {
-        if (!p.deinit) {
-          return
-        }
-        try {
-          await p.deinit()
-        } catch (error: any) {
-          this.logger.error("plugin failed to deinit", field("name", p.name), field("error", error.message))
-        }
-      }),
-    )
-  }
-}
-
-interface PackageJSON {
-  name: string
-  version: string
-  engines: {
-    "code-server": string
-  }
-}
-
-function q(s: string | undefined): string {
-  if (s === undefined) {
-    s = "undefined"
-  }
-  return JSON.stringify(s)
-}
--- a/src/node/routes/apps.ts
+++ b/src/node/routes/apps.ts
@@ -1,17 +0,0 @@
-import * as express from "express"
-import { PluginAPI } from "../plugin"
-
-/**
- * Implements the /api/applications endpoint
- *
- * See typings/pluginapi.d.ts for details.
- */
-export function router(papi: PluginAPI): express.Router {
-  const router = express.Router()
-
-  router.get("/", async (req, res) => {
-    res.json(await papi.applications())
-  })
-
-  return router
-}
--- a/src/node/routes/domainProxy.ts
+++ b/src/node/routes/domainProxy.ts
@@ -61,6 +61,11 @@ router.all(/.*/, async (req, res, next) => {

  ensureProxyEnabled(req)

+  if (req.method === "OPTIONS" && req.args["skip-auth-preflight"]) {
+    // Allow preflight requests with `skip-auth-preflight` flag
+    return next()
+  }
+
  // Must be authenticated to use the proxy.
  const isAuthenticated = await authenticated(req)
  if (!isAuthenticated) {
--- a/src/node/routes/errors.ts
+++ b/src/node/routes/errors.ts
@@ -2,11 +2,11 @@ import { logger } from "@coder/logger"
 import express from "express"
 import { promises as fs } from "fs"
 import path from "path"
-import { WebsocketRequest } from "../../../typings/pluginapi"
 import { HttpCode } from "../../common/http"
 import { rootPath } from "../constants"
 import { replaceTemplates } from "../http"
 import { escapeHtml, getMediaMime } from "../util"
+import type { WebsocketRequest } from "../wsRouter"

 interface ErrorWithStatusCode {
  statusCode: number
--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -4,7 +4,6 @@ import * as express from "express"
 import { promises as fs } from "fs"
 import * as path from "path"
 import * as tls from "tls"
-import * as pluginapi from "../../../typings/pluginapi"
 import { Disposable } from "../../common/emitter"
 import { HttpCode, HttpError } from "../../common/http"
 import { plural } from "../../common/util"
@@ -12,12 +11,11 @@ import { App } from "../app"
 import { AuthType, DefaultedArgs } from "../cli"
 import { commit, rootPath } from "../constants"
 import { Heart } from "../heart"
-import { ensureAuthenticated, redirect } from "../http"
-import { PluginAPI } from "../plugin"
+import { redirect } from "../http"
 import { CoderSettings, SettingsProvider } from "../settings"
 import { UpdateProvider } from "../update"
 import { getMediaMime, paths } from "../util"
-import * as apps from "./apps"
+import type { WebsocketRequest } from "../wsRouter"
 import * as domainProxy from "./domainProxy"
 import { errorHandler, wsErrorHandler } from "./errors"
 import * as health from "./health"
@@ -81,65 +79,53 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
  app.router.use(common)
  app.wsRouter.use(common)

-  app.router.use(async (req, res, next) => {
+  app.router.use(/.*/, async (req, res, next) => {
    // If we're handling TLS ensure all requests are redirected to HTTPS.
    // TODO: This does *NOT* work if you have a base path since to specify the
    // protocol we need to specify the whole path.
    if (args.cert && !(req.connection as tls.TLSSocket).encrypted) {
      return res.redirect(`https://${req.headers.host}${req.originalUrl}`)
    }
-
-    // Return security.txt.
-    if (req.originalUrl === "/security.txt" || req.originalUrl === "/.well-known/security.txt") {
-      const resourcePath = path.resolve(rootPath, "src/browser/security.txt")
-      res.set("Content-Type", getMediaMime(resourcePath))
-      return res.send(await fs.readFile(resourcePath))
-    }
-
-    // Return robots.txt.
-    if (req.originalUrl === "/robots.txt") {
-      const resourcePath = path.resolve(rootPath, "src/browser/robots.txt")
-      res.set("Content-Type", getMediaMime(resourcePath))
-      return res.send(await fs.readFile(resourcePath))
-    }
-
    next()
  })

+  app.router.get(["/security.txt", "/.well-known/security.txt"], async (_, res) => {
+    const resourcePath = path.resolve(rootPath, "src/browser/security.txt")
+    res.set("Content-Type", getMediaMime(resourcePath))
+    res.send(await fs.readFile(resourcePath))
+  })
+
+  app.router.get("/robots.txt", async (_, res) => {
+    const resourcePath = path.resolve(rootPath, "src/browser/robots.txt")
+    res.set("Content-Type", getMediaMime(resourcePath))
+    res.send(await fs.readFile(resourcePath))
+  })
+
  app.router.use("/", domainProxy.router)
  app.wsRouter.use("/", domainProxy.wsRouter.router)

-  app.router.all("/proxy/:port/:path(.*)?", async (req, res) => {
+  app.router.all("/proxy/:port{/*path}", async (req, res) => {
    await pathProxy.proxy(req, res)
  })
-  app.wsRouter.get("/proxy/:port/:path(.*)?", async (req) => {
-    await pathProxy.wsProxy(req as pluginapi.WebsocketRequest)
+  app.wsRouter.get("/proxy/:port{/*path}", async (req) => {
+    await pathProxy.wsProxy(req as unknown as WebsocketRequest)
  })
  // These two routes pass through the path directly.
  // So the proxied app must be aware it is running
  // under /absproxy/<someport>/
-  app.router.all("/absproxy/:port/:path(.*)?", async (req, res) => {
+  app.router.all("/absproxy/:port{/*path}", async (req, res) => {
    await pathProxy.proxy(req, res, {
      passthroughPath: true,
      proxyBasePath: args["abs-proxy-base-path"],
    })
  })
-  app.wsRouter.get("/absproxy/:port/:path(.*)?", async (req) => {
-    await pathProxy.wsProxy(req as pluginapi.WebsocketRequest, {
+  app.wsRouter.get("/absproxy/:port{/*path}", async (req) => {
+    await pathProxy.wsProxy(req as unknown as WebsocketRequest, {
      passthroughPath: true,
      proxyBasePath: args["abs-proxy-base-path"],
    })
  })

-  let pluginApi: PluginAPI
-  if (!process.env.CS_DISABLE_PLUGINS) {
-    const workingDir = args._ && args._.length > 0 ? path.resolve(args._[args._.length - 1]) : undefined
-    pluginApi = new PluginAPI(logger, process.env.CS_PLUGIN, process.env.CS_PLUGIN_PATH, workingDir)
-    await pluginApi.loadPlugins()
-    pluginApi.mount(app.router, app.wsRouter)
-    app.router.use("/api/applications", ensureAuthenticated, apps.router(pluginApi))
-  }
-
  app.router.use(express.json())
  app.router.use(express.urlencoded({ extended: true }))

@@ -172,7 +158,9 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl

  app.router.use("/update", update.router)

-  // Note that the root route is replaced in Coder Enterprise by the plugin API.
+  // For historic reasons we also load at /vscode because the root was replaced
+  // by a plugin in v1 of Coder.  The plugin system (which was for internal use
+  // only) has been removed, but leave the additional route for now.
  for (const routePrefix of ["/vscode", "/"]) {
    app.router.use(routePrefix, vscode.router)
    app.wsRouter.use(routePrefix, vscode.wsRouter.router)
@@ -187,7 +175,6 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl

  return () => {
    heart.dispose()
-    pluginApi?.dispose()
    vscode.dispose()
  }
 }
--- a/src/node/routes/pathProxy.ts
+++ b/src/node/routes/pathProxy.ts
@@ -1,9 +1,9 @@
 import { Request, Response } from "express"
 import * as path from "path"
-import * as pluginapi from "../../../typings/pluginapi"
 import { HttpCode, HttpError } from "../../common/http"
 import { ensureProxyEnabled, authenticated, ensureAuthenticated, ensureOrigin, redirect, self } from "../http"
 import { proxy as _proxy } from "../proxy"
+import type { WebsocketRequest } from "../wsRouter"

 const getProxyTarget = (
  req: Request,
@@ -13,7 +13,11 @@ const getProxyTarget = (
 ): string => {
  // If there is a base path, strip it out.
  const base = (req as any).base || ""
-  return `http://0.0.0.0:${req.params.port}${opts?.proxyBasePath || ""}/${req.originalUrl.slice(base.length)}`
+  const port = parseInt(req.params.port, 10)
+  if (isNaN(port)) {
+    throw new HttpError("Invalid port", HttpCode.BadRequest)
+  }
+  return `http://0.0.0.0:${port}${opts?.proxyBasePath || ""}/${req.originalUrl.slice(base.length)}`
 }

 export async function proxy(
@@ -26,7 +30,9 @@ export async function proxy(
 ): Promise<void> {
  ensureProxyEnabled(req)

-  if (!(await authenticated(req))) {
+  if (req.method === "OPTIONS" && req.args["skip-auth-preflight"]) {
+    // Allow preflight requests with `skip-auth-preflight` flag
+  } else if (!(await authenticated(req))) {
    // If visiting the root (/:port only) redirect to the login page.
    if (!req.params.path || req.params.path === "/") {
      const to = self(req)
@@ -49,7 +55,7 @@ export async function proxy(
 }

 export async function wsProxy(
-  req: pluginapi.WebsocketRequest,
+  req: WebsocketRequest,
  opts?: {
    passthroughPath?: boolean
    proxyBasePath?: string
--- a/src/node/routes/vscode.ts
+++ b/src/node/routes/vscode.ts
@@ -4,15 +4,15 @@ import * as express from "express"
 import { promises as fs } from "fs"
 import * as http from "http"
 import * as net from "net"
+import * as os from "os"
 import * as path from "path"
-import { WebsocketRequest } from "../../../typings/pluginapi"
 import { logError } from "../../common/util"
 import { CodeArgs, toCodeArgs } from "../cli"
 import { isDevMode, vsRootPath } from "../constants"
 import { authenticated, ensureAuthenticated, ensureOrigin, redirect, replaceTemplates, self } from "../http"
 import { SocketProxyProvider } from "../socket"
 import { isFile } from "../util"
-import { Router as WsRouter } from "../wsRouter"
+import { type WebsocketRequest, Router as WsRouter } from "../wsRouter"

 export const router = express.Router()

@@ -58,7 +58,11 @@ async function loadVSCode(req: express.Request): Promise<IVSCodeServerAPI> {
  // which will also require that we switch to ESM, since a hybrid approach
  // breaks importing `rotating-file-stream` for some reason.  To work around
  // this, use `eval` for now, but we should consider switching to ESM.
-  const modPath = path.join(vsRootPath, "out/server-main.js")
+  let modPath = path.join(vsRootPath, "out/server-main.js")
+  if (os.platform() === "win32") {
+    // On Windows, absolute paths of ESM modules must be a valid file URI.
+    modPath = "file:///" + modPath.replace(/\\/g, "/")
+  }
  const mod = (await eval(`import("${modPath}")`)) as VSCodeModule
  const serverModule = await mod.loadCodeWithNls()
  return serverModule.createServer(null, {
@@ -171,7 +175,7 @@ router.get("/manifest.json", async (req, res) => {
  const appName = req.args["app-name"] || "code-server"
  res.writeHead(200, { "Content-Type": "application/manifest+json" })

-  return res.end(
+  res.end(
    replaceTemplates(
      req,
      JSON.stringify(
--- a/src/node/settings.ts
+++ b/src/node/settings.ts
@@ -17,7 +17,7 @@ export class SettingsProvider<T> {
  public async read(): Promise<T> {
    try {
      const raw = (await fs.readFile(this.settingsPath, "utf8")).trim()
-      return raw ? JSON.parse(raw) : {}
+      return raw ? JSON.parse(raw) : ({} as T)
    } catch (error: any) {
      if (error.code !== "ENOENT") {
        logger.warn(error.message)
--- a/src/node/wsRouter.ts
+++ b/src/node/wsRouter.ts
@@ -1,8 +1,17 @@
 import * as express from "express"
 import * as expressCore from "express-serve-static-core"
 import * as http from "http"
+import * as stream from "stream"
 import Websocket from "ws"
-import * as pluginapi from "../../typings/pluginapi"
+
+export interface WebsocketRequest extends express.Request {
+  ws: stream.Duplex
+  head: Buffer
+}
+
+interface InternalWebsocketRequest extends WebsocketRequest {
+  _ws_handled: boolean
+}

 export const handleUpgrade = (app: express.Express, server: http.Server): void => {
  server.on("upgrade", (req, socket, head) => {
@@ -22,9 +31,11 @@ export const handleUpgrade = (app: express.Express, server: http.Server): void =
  })
 }

-interface InternalWebsocketRequest extends pluginapi.WebsocketRequest {
-  _ws_handled: boolean
-}
+export type WebSocketHandler = (
+  req: WebsocketRequest,
+  res: express.Response,
+  next: express.NextFunction,
+) => void | Promise<void>

 export class WebsocketRouter {
  public readonly router = express.Router()
@@ -36,13 +47,13 @@ export class WebsocketRouter {
   * If the origin header exists it must match the host or the connection will
   * be prevented.
   */
-  public ws(route: expressCore.PathParams, ...handlers: pluginapi.WebSocketHandler[]): void {
+  public ws(route: expressCore.PathParams, ...handlers: WebSocketHandler[]): void {
    this.router.get(
      route,
      ...handlers.map((handler) => {
        const wrapped: express.Handler = (req, res, next) => {
          ;(req as InternalWebsocketRequest)._ws_handled = true
-          return handler(req as pluginapi.WebsocketRequest, res, next)
+          return handler(req as WebsocketRequest, res, next)
        }
        return wrapped
      }),
--- a/test/e2e/routes.test.ts
+++ b/test/e2e/routes.test.ts
@@ -1,7 +1,26 @@
 import { clean, getMaybeProxiedPathname } from "../utils/helpers"
 import { describe, test, expect } from "./baseFixture"

-const routes = ["/", "/vscode", "/vscode/"]
+const routes = {
+  "/": [
+    /\.\/manifest.json/,
+    /\.\/_static\//,
+    /[a-z]+-[0-9a-z]+\/static\//,
+    /http:\/\/localhost:[0-9]+\/[a-z]+-[0-9a-z]+\/static\//,
+  ],
+  "/vscode": [
+    /\.\/vscode\/manifest.json/,
+    /\.\/_static\//,
+    /vscode\/[a-z]+-[0-9a-z]+\/static\//,
+    /http:\/\/localhost:[0-9]+\/vscode\/[a-z]+-[0-9a-z]+\/static\//,
+  ],
+  "/vscode/": [
+    /\.\/manifest.json/,
+    /\.\/\.\.\/_static\//,
+    /[a-z]+-[0-9a-z]+\/static\//,
+    /http:\/\/localhost:[0-9]+\/vscode\/[a-z]+-[0-9a-z]+\/static\//,
+  ],
+}

 describe("VS Code Routes", ["--disable-workspace-trust"], {}, async () => {
  const testName = "vscode-routes-default"
@@ -10,7 +29,7 @@ describe("VS Code Routes", ["--disable-workspace-trust"], {}, async () => {
  })

  test("should load all route variations", async ({ codeServerPage }) => {
-    for (const route of routes) {
+    for (const [route, matchers] of Object.entries(routes)) {
      await codeServerPage.navigate(route)

      // Check there were no redirections
@@ -18,21 +37,16 @@ describe("VS Code Routes", ["--disable-workspace-trust"], {}, async () => {
      const pathname = getMaybeProxiedPathname(url)
      expect(pathname).toBe(route)

-      // TODO@jsjoeio
-      // now that we are in a proper browser instead of scraping the HTML we
-      // could possibly intercept requests to make sure assets are loading from
-      // the right spot.
-      //
-      // Check that page loaded from correct route
-      const html = await codeServerPage.page.innerHTML("html")
-      switch (route) {
-        case "/":
-        case "/vscode/":
-          expect(html).toMatch(/src="\.\/[a-z]+-[0-9a-z]+\/static\//)
-          break
-        case "/vscode":
-          expect(html).toMatch(/src="\.\/vscode\/[a-z]+-[0-9a-z]+\/static\//)
-          break
+      // Check that assets are pointing to the right spot.  Some will be
+      // relative, without a leading dot (VS Code's assets).  Some will be
+      // relative with a leading dot (our assets).  Others will have been
+      // resolved against the origin.
+      const elements = await codeServerPage.page.locator("[src]").all()
+      for (const element of elements) {
+        const src = await element.getAttribute("src")
+        if (src && !matchers.some((m) => m.test(src))) {
+          throw new Error(`${src} did not match any validators for route ${route}`)
+        }
      }
    }
  })
@@ -85,7 +99,7 @@ describe("VS Code Routes with no workspace or folder", ["--disable-workspace-tru

    // If you visit again without query parameters it will re-attach them by
    // redirecting.  It should always redirect to the same route.
-    for (const route of routes) {
+    for (const route of Object.keys(routes)) {
      await codeServerPage.navigate(route)
      const url = new URL(codeServerPage.page.url())
      const pathname = getMaybeProxiedPathname(url)
--- a/test/tsconfig.json
+++ b/test/tsconfig.json
@@ -1,5 +1,4 @@
 {
  "extends": "../tsconfig.json",
-  "include": ["./**/*.ts"],
-  "exclude": ["./unit/node/test-plugin"]
+  "include": ["./**/*.ts"]
 }
--- a/test/unit/node/cli.test.ts
+++ b/test/unit/node/cli.test.ts
@@ -6,6 +6,7 @@ import {
  bindAddrFromArgs,
  defaultConfigFile,
  parse,
+  parseConfigFile,
  setDefaults,
  shouldOpenInExistingInstance,
  toCodeArgs,
@@ -108,6 +109,8 @@ describe("parser", () => {

          ["--abs-proxy-base-path", "/codeserver/app1"],

+          "--skip-auth-preflight",
+
          ["--session-socket", "/tmp/override-code-server-ipc-socket"],

          ["--host", "0.0.0.0"],
@@ -146,6 +149,7 @@ describe("parser", () => {
      "bind-addr": "192.169.0.1:8080",
      "session-socket": "/tmp/override-code-server-ipc-socket",
      "abs-proxy-base-path": "/codeserver/app1",
+      "skip-auth-preflight": true,
    })
  })

@@ -284,12 +288,17 @@ describe("parser", () => {
  })

  it("should support repeatable flags", async () => {
+    expect(() => parse(["--proxy-domain", ""])).toThrowError(/--proxy-domain requires a value/)
    expect(parse(["--proxy-domain", "*.coder.com"])).toEqual({
      "proxy-domain": ["*.coder.com"],
    })
    expect(parse(["--proxy-domain", "*.coder.com", "--proxy-domain", "test.com"])).toEqual({
      "proxy-domain": ["*.coder.com", "test.com"],
    })
+    // Commas are literal, at the moment.
+    expect(parse(["--proxy-domain", "*.coder.com,test.com"])).toEqual({
+      "proxy-domain": ["*.coder.com,test.com"],
+    })
  })

  it("should enforce cert-key with cert value or otherwise generate one", async () => {
@@ -487,6 +496,20 @@ describe("parser", () => {
      }),
    ).toThrowError(expectedErrMsg)
  })
+  it("should fail to parse invalid config", () => {
+    expect(() => parseConfigFile("test", "/fake-config-path")).toThrowError("invalid config: test")
+  })
+  it("should parse repeatable options", () => {
+    const configContents = `
+      install-extension:
+        - extension.number1
+        - extension.number2
+    `
+    expect(parseConfigFile(configContents, "/fake-config-path")).toEqual({
+      config: "/fake-config-path",
+      "install-extension": ["extension.number1", "extension.number2"],
+    })
+  })
  it("should ignore optional strings set to false", async () => {
    expect(parse(["--cert=false"])).toEqual({})
  })
--- a/test/unit/node/plugin.test.ts
+++ b/test/unit/node/plugin.test.ts
@@ -1,118 +0,0 @@
-import { logger } from "@coder/logger"
-import * as express from "express"
-import * as fs from "fs"
-import * as path from "path"
-import { HttpCode } from "../../../src/common/http"
-import { AuthType } from "../../../src/node/cli"
-import { codeServer, PluginAPI } from "../../../src/node/plugin"
-import * as apps from "../../../src/node/routes/apps"
-import * as httpserver from "../../utils/httpserver"
-const fsp = fs.promises
-
-// Jest overrides `require` so our usual override doesn't work.
-jest.mock("code-server", () => codeServer, { virtual: true })
-
-/**
- * Use $LOG_LEVEL=debug to see debug logs.
- */
-describe("plugin", () => {
-  let papi: PluginAPI
-  let s: httpserver.HttpServer
-
-  beforeAll(async () => {
-    // Only include the test plugin to avoid contaminating results with other
-    // plugins that might be on the filesystem.
-    papi = new PluginAPI(logger, `${path.resolve(__dirname, "test-plugin")}:meow`, "")
-    await papi.loadPlugins(false)
-
-    const app = express.default()
-    const wsApp = express.default()
-
-    const common: express.RequestHandler = (req, _, next) => {
-      // Routes might use these arguments.
-      req.args = {
-        _: [],
-        auth: AuthType.None,
-        host: "localhost",
-        port: 8080,
-        "proxy-domain": [],
-        config: "~/.config/code-server/config.yaml",
-        verbose: false,
-        "disable-file-downloads": false,
-        usingEnvPassword: false,
-        usingEnvHashedPassword: false,
-        "extensions-dir": "",
-        "user-data-dir": "",
-        "session-socket": "",
-      }
-      next()
-    }
-
-    app.use(common)
-    wsApp.use(common)
-
-    papi.mount(app, wsApp)
-    app.use("/api/applications", apps.router(papi))
-
-    s = new httpserver.HttpServer()
-    await s.listen(app)
-    s.listenUpgrade(wsApp)
-  })
-
-  afterAll(async () => {
-    await s.dispose()
-  })
-
-  it("/api/applications", async () => {
-    const resp = await s.fetch("/api/applications")
-    expect(resp.status).toBe(200)
-    const body = await resp.json()
-    logger.debug(`${JSON.stringify(body)}`)
-    expect(body).toStrictEqual([
-      {
-        name: "Test App",
-        version: "4.0.1",
-
-        description: "This app does XYZ.",
-        iconPath: "/test-plugin/test-app/icon.svg",
-        homepageURL: "https://example.com",
-        path: "/test-plugin/test-app",
-
-        plugin: {
-          name: "test-plugin",
-          version: "1.0.0",
-          modulePath: path.join(__dirname, "test-plugin"),
-
-          displayName: "Test Plugin",
-          description: "Plugin used in code-server tests.",
-          routerPath: "/test-plugin",
-          homepageURL: "https://example.com",
-        },
-      },
-    ])
-  })
-
-  it("/test-plugin/test-app", async () => {
-    const indexHTML = await fsp.readFile(path.join(__dirname, "test-plugin/public/index.html"), {
-      encoding: "utf8",
-    })
-    const resp = await s.fetch("/test-plugin/test-app")
-    expect(resp.status).toBe(200)
-    const body = await resp.text()
-    expect(body).toBe(indexHTML)
-  })
-
-  it("/test-plugin/test-app (websocket)", async () => {
-    const ws = s.ws("/test-plugin/test-app")
-    const message = await new Promise((resolve) => {
-      ws.once("message", (message) => resolve(message))
-    })
-    ws.terminate()
-    expect(message).toBe("hello")
-  })
-
-  it("/test-plugin/error", async () => {
-    const resp = await s.fetch("/test-plugin/error")
-    expect(resp.status).toBe(HttpCode.LargePayload)
-  })
-})
--- a/test/unit/node/proxy.test.ts
+++ b/test/unit/node/proxy.test.ts
@@ -268,6 +268,21 @@ describe("proxy", () => {
    const text = await resp.text()
    expect(text).toBe("app being served behind a prefixed path")
  })
+
+  it("should not allow OPTIONS without authentication by default", async () => {
+    process.env.PASSWORD = "test"
+    codeServer = await integration.setup(["--auth=password"])
+    const resp = await codeServer.fetch(proxyPath, { method: "OPTIONS" })
+    expect(resp.status).toBe(401)
+  })
+
+  it("should allow OPTIONS with `skip-auth-preflight` flag", async () => {
+    process.env.PASSWORD = "test"
+    codeServer = await integration.setup(["--auth=password", "--skip-auth-preflight"])
+    e.post("/wsup", (req, res) => {})
+    const resp = await codeServer.fetch(proxyPath, { method: "OPTIONS" })
+    expect(resp.status).toBe(200)
+  })
 })

 // NOTE@jsjoeio
--- a/test/unit/node/settings.test.ts
+++ b/test/unit/node/settings.test.ts
@@ -29,7 +29,7 @@ describe("settings", () => {
      const settings = new SettingsProvider<CoderSettings>(pathToMockSettingsFile)
      await settings.read()
      // This happens when we can't parse a JSON (usually error in file)
-      expect(logger.warn).toHaveBeenCalledWith(expect.stringMatching(/Unexpected token/))
+      expect(logger.warn).toHaveBeenCalledWith(expect.stringMatching(/Expected ':'/))
    })
  })
  describe("with invalid settings file path", () => {
--- a/test/unit/node/test-plugin/.eslintrc.js
+++ b/test/unit/node/test-plugin/.eslintrc.js
@@ -1,9 +0,0 @@
-module.exports = {
-  settings: {
-    "import/resolver": {
-      typescript: {
-        project: __dirname,
-      },
-    },
-  },
-}
--- a/test/unit/node/test-plugin/.gitignore
+++ b/test/unit/node/test-plugin/.gitignore
@@ -1 +0,0 @@
-out
--- a/test/unit/node/test-plugin/Makefile
+++ b/test/unit/node/test-plugin/Makefile
@@ -1,6 +0,0 @@
-out/index.js: src/index.ts
-	# Typescript always emits, even on errors.
-	npm run build || rm out/index.js
-
-node_modules: package.json package-lock.json
-	npm install
--- a/test/unit/node/test-plugin/package-lock.json
+++ b/test/unit/node/test-plugin/package-lock.json
@@ -1,90 +0,0 @@
-{
-  "name": "test-plugin",
-  "version": "1.0.0",
-  "lockfileVersion": 1,
-  "requires": true,
-  "dependencies": {
-    "@types/body-parser": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.0.tgz",
-      "integrity": "sha512-W98JrE0j2K78swW4ukqMleo8R7h/pFETjM2DQ90MF6XK2i4LO4W3gQ71Lt4w3bfm2EvVSyWHplECvB5sK22yFQ==",
-      "requires": {
-        "@types/connect": "*",
-        "@types/node": "*"
-      },
-      "dev": true
-    },
-    "@types/connect": {
-      "version": "3.4.33",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.33.tgz",
-      "integrity": "sha512-2+FrkXY4zllzTNfJth7jOqEHC+enpLeGslEhpnTAkg21GkRrWV4SsAtqchtT4YS9/nODBU2/ZfsBY2X4J/dX7A==",
-      "requires": {
-        "@types/node": "*"
-      },
-      "dev": true
-    },
-    "@types/express": {
-      "version": "4.17.8",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.8.tgz",
-      "integrity": "sha512-wLhcKh3PMlyA2cNAB9sjM1BntnhPMiM0JOBwPBqttjHev2428MLEB4AYVN+d8s2iyCVZac+o41Pflm/ZH5vLXQ==",
-      "requires": {
-        "@types/body-parser": "*",
-        "@types/express-serve-static-core": "*",
-        "@types/qs": "*",
-        "@types/serve-static": "*"
-      },
-      "dev": true
-    },
-    "@types/express-serve-static-core": {
-      "version": "4.17.13",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.13.tgz",
-      "integrity": "sha512-RgDi5a4nuzam073lRGKTUIaL3eF2+H7LJvJ8eUnCI0wA6SNjXc44DCmWNiTLs/AZ7QlsFWZiw/gTG3nSQGL0fA==",
-      "requires": {
-        "@types/node": "*",
-        "@types/qs": "*",
-        "@types/range-parser": "*"
-      },
-      "dev": true
-    },
-    "@types/mime": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-2.0.3.tgz",
-      "integrity": "sha512-Jus9s4CDbqwocc5pOAnh8ShfrnMcPHuJYzVcSUU7lrh8Ni5HuIqX3oilL86p3dlTrk0LzHRCgA/GQ7uNCw6l2Q==",
-      "dev": true
-    },
-    "@types/node": {
-      "version": "14.14.6",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-14.14.6.tgz",
-      "integrity": "sha512-6QlRuqsQ/Ox/aJEQWBEJG7A9+u7oSYl3mem/K8IzxXG/kAGbV1YPD9Bg9Zw3vyxC/YP+zONKwy8hGkSt1jxFMw==",
-      "dev": true
-    },
-    "@types/qs": {
-      "version": "6.9.5",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.5.tgz",
-      "integrity": "sha512-/JHkVHtx/REVG0VVToGRGH2+23hsYLHdyG+GrvoUGlGAd0ErauXDyvHtRI/7H7mzLm+tBCKA7pfcpkQ1lf58iQ==",
-      "dev": true
-    },
-    "@types/range-parser": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.3.tgz",
-      "integrity": "sha512-ewFXqrQHlFsgc09MK5jP5iR7vumV/BYayNC6PgJO2LPe8vrnNFyjQjSppfEngITi0qvfKtzFvgKymGheFM9UOA==",
-      "dev": true
-    },
-    "@types/serve-static": {
-      "version": "1.13.6",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.13.6.tgz",
-      "integrity": "sha512-nuRJmv7jW7VmCVTn+IgYDkkbbDGyIINOeu/G0d74X3lm6E5KfMeQPJhxIt1ayQeQB3cSxvYs1RA/wipYoFB4EA==",
-      "requires": {
-        "@types/mime": "*",
-        "@types/node": "*"
-      },
-      "dev": true
-    },
-    "typescript": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.0.5.tgz",
-      "integrity": "sha512-ywmr/VrTVCmNTJ6iV2LwIrfG1P+lv6luD8sUJs+2eI9NLGigaN+nUQc13iHqisq7bra9lnmUSYqbJvegraBOPQ==",
-      "dev": true
-    }
-  }
-}
--- a/test/unit/node/test-plugin/package.json
+++ b/test/unit/node/test-plugin/package.json
@@ -1,16 +0,0 @@
-{
-  "private": true,
-  "name": "test-plugin",
-  "version": "1.0.0",
-  "engines": {
-    "code-server": "*"
-  },
-  "main": "out/index.js",
-  "devDependencies": {
-    "@types/express": "^4.17.8",
-    "typescript": "^4.0.5"
-  },
-  "scripts": {
-    "build": "tsc"
-  }
-}
--- a/test/unit/node/test-plugin/public/icon.svg
+++ b/test/unit/node/test-plugin/public/icon.svg
@@ -1 +0,0 @@
-<svg width="121" height="131" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient x1="9.612%" y1="66.482%" x2="89.899%" y2="33.523%" id="a"><stop stop-color="#FCEE39" offset="0%"/><stop stop-color="#F37B3D" offset="100%"/></linearGradient><linearGradient x1="8.601%" y1="15.03%" x2="99.641%" y2="89.058%" id="b"><stop stop-color="#EF5A6B" offset="0%"/><stop stop-color="#F26F4E" offset="57%"/><stop stop-color="#F37B3D" offset="100%"/></linearGradient><linearGradient x1="90.118%" y1="69.931%" x2="17.938%" y2="38.628%" id="c"><stop stop-color="#7C59A4" offset="0%"/><stop stop-color="#AF4C92" offset="38.52%"/><stop stop-color="#DC4183" offset="76.54%"/><stop stop-color="#ED3D7D" offset="95.7%"/></linearGradient><linearGradient x1="91.376%" y1="19.144%" x2="18.895%" y2="70.21%" id="d"><stop stop-color="#EF5A6B" offset="0%"/><stop stop-color="#EE4E72" offset="36.4%"/><stop stop-color="#ED3D7D" offset="100%"/></linearGradient></defs><g fill="none"><path d="M118.623 71.8c.9-.8 1.4-1.9 1.5-3.2.1-2.6-1.8-4.7-4.4-4.9-1.2-.1-2.4.4-3.3 1.1l-83.8 45.9c-1.9.8-3.6 2.2-4.7 4.1-2.9 4.8-1.3 11 3.6 13.9 3.4 2 7.5 1.8 10.7-.2.2-.2.5-.3.7-.5l78-54.8c.4-.3 1.5-1.1 1.7-1.4z" fill="url(#a)" transform="translate(-.023)"/><path d="M118.823 65.1l-63.8-62.6c-1.4-1.5-3.4-2.5-5.7-2.5-4.3 0-7.7 3.5-7.7 7.7 0 2.1.8 3.9 2.1 5.3.4.4.8.7 1.2 1l67.4 57.7c.8.7 1.8 1.2 3 1.3 2.6.1 4.7-1.8 4.9-4.4 0-1.3-.5-2.6-1.4-3.5z" fill="url(#b)" transform="translate(-.023)"/><path d="M57.123 59.5c-.1 0-39.4-31-40.2-31.5l-1.8-.9c-5.8-2.2-12.2.8-14.4 6.6-1.9 5.1.2 10.7 4.6 13.4.7.4 1.3.7 2 .9.4.2 45.4 18.8 45.4 18.8 1.8.8 3.9.3 5.1-1.2 1.5-1.9 1.2-4.6-.7-6.1z" fill="url(#c)" transform="translate(-.023)"/><path d="M49.323 0c-1.7 0-3.3.6-4.6 1.5l-39.8 26.8c-.1.1-.2.1-.2.2h-.1c-1.7 1.2-3.1 3-3.9 5.1-2.2 5.8.8 12.3 6.6 14.4 3.6 1.4 7.5.7 10.4-1.4.7-.5 1.3-1 1.8-1.6l34.6-31.2c1.8-1.4 3-3.6 3-6.1 0-4.2-3.5-7.7-7.8-7.7z" fill="url(#d)" transform="translate(-.023)"/><path fill="#000" d="M34.6 37.4h51v51h-51z"/><path fill="#FFF" d="M39 78.8h19.1V82H39zm-.2-28l1.5-1.4c.4.5.8.8 1.3.8.6 0 .9-.4.9-1.2v-5.3h2.3V49c0 1-.3 1.8-.8 2.3-.5.5-1.3.8-2.3.8-1.5.1-2.3-.5-2.9-1.3zm6.5-7H52v1.9h-4.4V47h4v1.8h-4v1.3h4.5v2h-6.7zm9.7 2h-2.5v-2h7.3v2h-2.5v6.3H55zM39 54h4.3c1 0 1.8.3 2.3.7.3.3.5.8.5 1.4 0 1-.5 1.5-1.3 1.9 1 .3 1.6.9 1.6 2 0 1.4-1.2 2.3-3.1 2.3H39V54zm4.8 2.6c0-.5-.4-.7-1-.7h-1.5v1.5h1.4c.7-.1 1.1-.3 1.1-.8zM43 59h-1.8v1.5H43c.7 0 1.1-.3 1.1-.8s-.4-.7-1.1-.7zm3.8-5h3.9c1.3 0 2.1.3 2.7.9.5.5.7 1.1.7 1.9 0 1.3-.7 2.1-1.7 2.6l2 2.9h-2.6l-1.7-2.5h-1v2.5h-2.3V54zm3.8 4c.8 0 1.2-.4 1.2-1 0-.7-.5-1-1.2-1h-1.5v2h1.5z"/><path d="M56.8 54H59l3.5 8.4H60l-.6-1.5h-3.2l-.6 1.5h-2.4l3.6-8.4zm2 5l-.9-2.3L57 59h1.8zm4-5h2.3v8.3h-2.3zm2.9 0h2.1l3.4 4.4V54h2.3v8.3h-2L68 57.8v4.6h-2.3zm8 7.1l1.3-1.5c.8.7 1.7 1 2.7 1 .6 0 1-.2 1-.6 0-.4-.3-.5-1.4-.8-1.8-.4-3.1-.9-3.1-2.6 0-1.5 1.2-2.7 3.2-2.7 1.4 0 2.5.4 3.4 1.1l-1.2 1.6c-.8-.5-1.6-.8-2.3-.8-.6 0-.8.2-.8.5 0 .4.3.5 1.4.8 1.9.4 3.1 1 3.1 2.6 0 1.7-1.3 2.7-3.4 2.7-1.5.1-2.9-.4-3.9-1.3z" fill="#FFF"/></g></svg>
--- a/test/unit/node/test-plugin/public/index.html
+++ b/test/unit/node/test-plugin/public/index.html
@@ -1,10 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <title>Test Plugin</title>
-  </head>
-  <body>
-    <p>Welcome to the test plugin!</p>
-  </body>
-</html>
--- a/test/unit/node/test-plugin/src/index.ts
+++ b/test/unit/node/test-plugin/src/index.ts
@@ -1,52 +0,0 @@
-import * as cs from "code-server"
-import * as fspath from "path"
-
-export const plugin: cs.Plugin = {
-  displayName: "Test Plugin",
-  routerPath: "/test-plugin",
-  homepageURL: "https://example.com",
-  description: "Plugin used in code-server tests.",
-
-  init(config) {
-    config.logger.debug("test-plugin loaded!")
-  },
-
-  router() {
-    const r = cs.express.Router()
-    r.get("/test-app", (_, res) => {
-      res.sendFile(fspath.resolve(__dirname, "../public/index.html"))
-    })
-    r.get("/goland/icon.svg", (_, res) => {
-      res.sendFile(fspath.resolve(__dirname, "../public/icon.svg"))
-    })
-    r.get("/error", () => {
-      throw new cs.HttpError("error", cs.HttpCode.LargePayload)
-    })
-    return r
-  },
-
-  wsRouter() {
-    const wr = cs.WsRouter()
-    wr.ws("/test-app", (req) => {
-      cs.wss.handleUpgrade(req, req.ws, req.head, (ws) => {
-        req.ws.resume()
-        ws.send("hello")
-      })
-    })
-    return wr
-  },
-
-  applications() {
-    return [
-      {
-        name: "Test App",
-        version: "4.0.1",
-        iconPath: "/icon.svg",
-        path: "/test-app",
-
-        description: "This app does XYZ.",
-        homepageURL: "https://example.com",
-      },
-    ]
-  },
-}
--- a/test/unit/node/test-plugin/tsconfig.json
+++ b/test/unit/node/test-plugin/tsconfig.json
@@ -1,71 +0,0 @@
-{
-  "compilerOptions": {
-    /* Visit https://aka.ms/tsconfig.json to read more about this file */
-
-    /* Basic Options */
-    // "incremental": true,                   /* Enable incremental compilation */
-    "target": "es5" /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019', 'ES2020', or 'ESNEXT'. */,
-    "module": "commonjs" /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', 'es2020', or 'ESNext'. */,
-    // "lib": [],                             /* Specify library files to be included in the compilation. */
-    // "allowJs": true,                       /* Allow javascript files to be compiled. */
-    // "checkJs": true,                       /* Report errors in .js files. */
-    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
-    // "declaration": true,                   /* Generates corresponding '.d.ts' file. */
-    // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
-    // "sourceMap": true,                     /* Generates corresponding '.map' file. */
-    // "outFile": "./",                       /* Concatenate and emit output to single file. */
-    "outDir": "./out" /* Redirect output structure to the directory. */,
-    // "rootDir": "./",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
-    // "composite": true,                     /* Enable project compilation */
-    // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
-    // "removeComments": true,                /* Do not emit comments to output. */
-    // "noEmit": true,                        /* Do not emit outputs. */
-    // "importHelpers": true,                 /* Import emit helpers from 'tslib'. */
-    // "downlevelIteration": true,            /* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
-    // "isolatedModules": true,               /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */
-
-    /* Strict Type-Checking Options */
-    "strict": true /* Enable all strict type-checking options. */,
-    // "noImplicitAny": true,                 /* Raise error on expressions and declarations with an implied 'any' type. */
-    // "strictNullChecks": true,              /* Enable strict null checks. */
-    // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
-    // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
-    // "strictPropertyInitialization": true,  /* Enable strict checking of property initialization in classes. */
-    // "noImplicitThis": true,                /* Raise error on 'this' expressions with an implied 'any' type. */
-    // "alwaysStrict": true,                  /* Parse in strict mode and emit "use strict" for each source file. */
-
-    /* Additional Checks */
-    // "noUnusedLocals": true,                /* Report errors on unused locals. */
-    // "noUnusedParameters": true,            /* Report errors on unused parameters. */
-    // "noImplicitReturns": true,             /* Report error when not all code paths in function return a value. */
-    // "noFallthroughCasesInSwitch": true,    /* Report errors for fallthrough cases in switch statement. */
-
-    /* Module Resolution Options */
-    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
-    "baseUrl": "./" /* Base directory to resolve non-absolute module names. */,
-    "paths": {
-      "code-server": ["../../../../typings/pluginapi"]
-    } /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */,
-    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
-    // "typeRoots": [],                       /* List of folders to include type definitions from. */
-    // "types": [],                           /* Type declaration files to be included in compilation. */
-    // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
-    "esModuleInterop": true /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */,
-    // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
-    // "allowUmdGlobalAccess": true,          /* Allow accessing UMD globals from modules. */
-
-    /* Source Map Options */
-    // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
-    // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
-    // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
-    // "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
-
-    /* Experimental Options */
-    // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
-    // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
-
-    /* Advanced Options */
-    "skipLibCheck": true /* Skip type checking of declaration files. */,
-    "forceConsistentCasingInFileNames": true /* Disallow inconsistently-cased references to the same file. */
-  }
-}
--- a/typings/pluginapi.d.ts
+++ b/typings/pluginapi.d.ts
@@ -1,297 +0,0 @@
-/**
- * This file describes the code-server plugin API for adding new applications.
- */
-import { field, Level, Logger } from "@coder/logger"
-import * as express from "express"
-import * as expressCore from "express-serve-static-core"
-import ProxyServer from "http-proxy"
-import * as stream from "stream"
-import Websocket from "ws"
-
-/**
- * Overlay
- *
- * The homepage of code-server will launch into VS Code. However, there will be an overlay
- * button that when clicked, will show all available applications with their names,
- * icons and provider plugins. When one clicks on an app's icon, they will be directed
- * to <code-server-root>/<plugin-path>/<app-path> to access the application.
- */
-
-/**
- * Plugins
- *
- * Plugins are just node modules that contain a top level export "plugin" that implements
- * the Plugin interface.
- *
- * 1. code-server uses $CS_PLUGIN to find plugins.
- *
- * e.g. CS_PLUGIN=/tmp/will:/tmp/teffen will cause code-server to load
- * /tmp/will and /tmp/teffen as plugins.
- *
- * 2. code-server uses $CS_PLUGIN_PATH to find plugins. Each subdirectory in
- * $CS_PLUGIN_PATH with a package.json where the engine is code-server is
- * a valid plugin.
- *
- * e.g. CS_PLUGIN_PATH=/tmp/nhooyr:/tmp/ash will cause code-server to search
- * /tmp/nhooyr and then /tmp/ash for plugins.
- *
- * CS_PLUGIN_PATH defaults to
- * ~/.local/share/code-server/plugins:/usr/share/code-server/plugins
- * if unset.
- *
- *
- * 3. Built in plugins are loaded from __dirname/../plugins
- *
- * Plugins are required as soon as they are found and then initialized.
- * See the Plugin interface for details.
- *
- * If two plugins are found with the exact same name, then code-server will
- * use the first one and emit a warning.
- *
- */
-
-/**
- * Programmability
- *
- * There is also a /api/applications endpoint to allow programmatic access to all
- * available applications. It could be used to create a custom application dashboard
- * for example. An important difference with the API is that all application paths
- * will be absolute (i.e have the plugin path prepended) so that they may be used
- * directly.
- *
- * Example output:
- *
- * [
- *   {
- *     "name": "Test App",
- *     "version": "4.0.1",
- *     "iconPath": "/test-plugin/test-app/icon.svg",
- *     "path": "/test-plugin/test-app",
- *     "description": "This app does XYZ.",
- *     "homepageURL": "https://example.com",
- *     "plugin": {
- *       "name": "test-plugin",
- *       "version": "1.0.0",
- *       "modulePath": "/Users/nhooyr/src/coder/code-server/test/test-plugin",
- *       "displayName": "Test Plugin",
- *       "description": "Plugin used in code-server tests.",
- *       "routerPath": "/test-plugin",
- *       "homepageURL": "https://example.com"
- *     }
- *   }
- * ]
- */
-
-export enum HttpCode {
-  Ok = 200,
-  Redirect = 302,
-  NotFound = 404,
-  BadRequest = 400,
-  Unauthorized = 401,
-  LargePayload = 413,
-  ServerError = 500,
-}
-
-export declare class HttpError extends Error {
-  constructor(message: string, status: HttpCode, details?: object)
-}
-
-export interface WebsocketRequest extends express.Request {
-  ws: stream.Duplex
-  head: Buffer
-}
-
-export type WebSocketHandler = (
-  req: WebsocketRequest,
-  res: express.Response,
-  next: express.NextFunction,
-) => void | Promise<void>
-
-export interface WebsocketRouter {
-  readonly router: express.Router
-  ws(route: expressCore.PathParams, ...handlers: WebSocketHandler[]): void
-}
-
-/**
- * Create a router for websocket routes.
- */
-export function WsRouter(): WebsocketRouter
-
-/**
- * The websocket server used by code-server.
- */
-export const wss: Websocket.Server
-
-/**
- * The Express import used by code-server.
- *
- * Re-exported so plugins don't have to import duplicate copies of Express and
- * to avoid potential version differences or issues caused by running separate
- * instances.
- */
-export { express }
-/**
- * Use to add a field to a log.
- *
- * Re-exported so plugins don't have to import duplicate copies of the logger.
- */
-export { field, Level, Logger }
-
-/**
- * code-server's proxy server.
- */
-export const proxy: ProxyServer
-
-/**
- * Middleware to ensure the user is authenticated. Throws if they are not.
- */
-export function ensureAuthenticated(
-  req: express.Request,
-  res?: express.Response,
-  next?: express.NextFunction,
-): Promise<void>
-
-/**
- * Returns true if the user is authenticated.
- */
-export function authenticated(req: express.Request): Promise<void>
-
-/**
- * Replace variables in HTML: TO, BASE, CS_STATIC_BASE, and OPTIONS.
- */
-export function replaceTemplates<T extends object>(
-  req: express.Request,
-  content: string,
-  extraOpts?: Omit<T, "base" | "csStaticBase" | "logLevel">,
-): string
-
-/**
- * Your plugin module must have a top level export "plugin" that implements this interface.
- *
- * The plugin's router will be mounted at <code-sever-root>/<plugin-path>
- */
-export interface Plugin {
-  /**
-   * name is used as the plugin's unique identifier.
-   * No two plugins may share the same name.
-   *
-   * Fetched from package.json.
-   */
-  readonly name?: string
-
-  /**
-   * The version for the plugin in the overlay.
-   *
-   * Fetched from package.json.
-   */
-  readonly version?: string
-
-  /**
-   * Name used in the overlay.
-   */
-  readonly displayName: string
-
-  /**
-   * Used in overlay.
-   * Should be a full sentence describing the plugin.
-   */
-  readonly description: string
-
-  /**
-   * The path at which the plugin router is to be registered.
-   */
-  readonly routerPath: string
-
-  /**
-   * Link to plugin homepage.
-   */
-  readonly homepageURL: string
-
-  /**
-   * init is called so that the plugin may initialize itself with the config.
-   */
-  init(config: PluginConfig): void
-
-  /**
-   * Called when the plugin should dispose/shutdown everything.
-   */
-  deinit?(): Promise<void>
-
-  /**
-   * Returns the plugin's router.
-   *
-   * Mounted at <code-sever-root>/<plugin-path>
-   *
-   * If not present, the plugin provides no routes.
-   */
-  router?(): express.Router
-
-  /**
-   * Returns the plugin's websocket router.
-   *
-   * Mounted at <code-sever-root>/<plugin-path>
-   *
-   * If not present, the plugin provides no websockets.
-   */
-  wsRouter?(): WebsocketRouter
-
-  /**
-   * code-server uses this to collect the list of applications that
-   * the plugin can currently provide.
-   * It is called when /api/applications is hit or the overlay needs to
-   * refresh the list of applications
-   *
-   * Ensure this is as fast as possible.
-   *
-   * If not present, the plugin provides no applications.
-   */
-  applications?(): Application[] | Promise<Application[]>
-}
-
-/**
- * PluginConfig contains the configuration required for initializing
- * a plugin.
- */
-export interface PluginConfig {
-  /**
-   * All plugin logs should be logged via this logger.
-   */
-  readonly logger: Logger
-
-  /**
-   * This can be specified by the user on the command line. Plugins should
-   * default to this directory when applicable. For example, the Jupyter plugin
-   * uses this to launch in this directory.
-   */
-  readonly workingDirectory?: string
-}
-
-/**
- * Application represents a user accessible application.
- */
-export interface Application {
-  readonly name: string
-  readonly version: string
-
-  /**
-   * When the user clicks on the icon in the overlay, they will be
-   * redirected to <code-server-root>/<plugin-path>/<app-path>
-   * where the application should be accessible.
-   *
-   * If undefined, then <code-server-root>/<plugin-path> is used.
-   */
-  readonly path?: string
-
-  readonly description?: string
-
-  /**
-   * The path at which the icon for this application can be accessed.
-   * <code-server-root>/<plugin-path>/<app-path>/<icon-path>
-   */
-  readonly iconPath: string
-
-  /**
-   * Link to application homepage.
-   */
-  readonly homepageURL: string
-}
@@ -1 +1 @@
 .18.0
 .15.1
				`@@ -1 +0,0 @@`
				<svg width="121" height="131" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient x1="9.612%" y1="66.482%" x2="89.899%" y2="33.523%" id="a"><stop stop-color="#FCEE39" offset="0%"/><stop stop-color="#F37B3D" offset="100%"/></linearGradient><linearGradient x1="8.601%" y1="15.03%" x2="99.641%" y2="89.058%" id="b"><stop stop-color="#EF5A6B" offset="0%"/><stop stop-color="#F26F4E" offset="57%"/><stop stop-color="#F37B3D" offset="100%"/></linearGradient><linearGradient x1="90.118%" y1="69.931%" x2="17.938%" y2="38.628%" id="c"><stop stop-color="#7C59A4" offset="0%"/><stop stop-color="#AF4C92" offset="38.52%"/><stop stop-color="#DC4183" offset="76.54%"/><stop stop-color="#ED3D7D" offset="95.7%"/></linearGradient><linearGradient x1="91.376%" y1="19.144%" x2="18.895%" y2="70.21%" id="d"><stop stop-color="#EF5A6B" offset="0%"/><stop stop-color="#EE4E72" offset="36.4%"/><stop stop-color="#ED3D7D" offset="100%"/></linearGradient></defs><g fill="none"><path d="M118.623 71.8c.9-.8 1.4-1.9 1.5-3.2.1-2.6-1.8-4.7-4.4-4.9-1.2-.1-2.4.4-3.3 1.1l-83.8 45.9c-1.9.8-3.6 2.2-4.7 4.1-2.9 4.8-1.3 11 3.6 13.9 3.4 2 7.5 1.8 10.7-.2.2-.2.5-.3.7-.5l78-54.8c.4-.3 1.5-1.1 1.7-1.4z" fill="url(#a)" transform="translate(-.023)"/><path d="M118.823 65.1l-63.8-62.6c-1.4-1.5-3.4-2.5-5.7-2.5-4.3 0-7.7 3.5-7.7 7.7 0 2.1.8 3.9 2.1 5.3.4.4.8.7 1.2 1l67.4 57.7c.8.7 1.8 1.2 3 1.3 2.6.1 4.7-1.8 4.9-4.4 0-1.3-.5-2.6-1.4-3.5z" fill="url(#b)" transform="translate(-.023)"/><path d="M57.123 59.5c-.1 0-39.4-31-40.2-31.5l-1.8-.9c-5.8-2.2-12.2.8-14.4 6.6-1.9 5.1.2 10.7 4.6 13.4.7.4 1.3.7 2 .9.4.2 45.4 18.8 45.4 18.8 1.8.8 3.9.3 5.1-1.2 1.5-1.9 1.2-4.6-.7-6.1z" fill="url(#c)" transform="translate(-.023)"/><path d="M49.323 0c-1.7 0-3.3.6-4.6 1.5l-39.8 26.8c-.1.1-.2.1-.2.2h-.1c-1.7 1.2-3.1 3-3.9 5.1-2.2 5.8.8 12.3 6.6 14.4 3.6 1.4 7.5.7 10.4-1.4.7-.5 1.3-1 1.8-1.6l34.6-31.2c1.8-1.4 3-3.6 3-6.1 0-4.2-3.5-7.7-7.8-7.7z" fill="url(#d)" transform="translate(-.023)"/><path fill="#000" d="M34.6 37.4h51v51h-51z"/><path fill="#FFF" d="M39 78.8h19.1V82H39zm-.2-28l1.5-1.4c.4.5.8.8 1.3.8.6 0 .9-.4.9-1.2v-5.3h2.3V49c0 1-.3 1.8-.8 2.3-.5.5-1.3.8-2.3.8-1.5.1-2.3-.5-2.9-1.3zm6.5-7H52v1.9h-4.4V47h4v1.8h-4v1.3h4.5v2h-6.7zm9.7 2h-2.5v-2h7.3v2h-2.5v6.3H55zM39 54h4.3c1 0 1.8.3 2.3.7.3.3.5.8.5 1.4 0 1-.5 1.5-1.3 1.9 1 .3 1.6.9 1.6 2 0 1.4-1.2 2.3-3.1 2.3H39V54zm4.8 2.6c0-.5-.4-.7-1-.7h-1.5v1.5h1.4c.7-.1 1.1-.3 1.1-.8zM43 59h-1.8v1.5H43c.7 0 1.1-.3 1.1-.8s-.4-.7-1.1-.7zm3.8-5h3.9c1.3 0 2.1.3 2.7.9.5.5.7 1.1.7 1.9 0 1.3-.7 2.1-1.7 2.6l2 2.9h-2.6l-1.7-2.5h-1v2.5h-2.3V54zm3.8 4c.8 0 1.2-.4 1.2-1 0-.7-.5-1-1.2-1h-1.5v2h1.5z"/><path d="M56.8 54H59l3.5 8.4H60l-.6-1.5h-3.2l-.6 1.5h-2.4l3.6-8.4zm2 5l-.9-2.3L57 59h1.8zm4-5h2.3v8.3h-2.3zm2.9 0h2.1l3.4 4.4V54h2.3v8.3h-2L68 57.8v4.6h-2.3zm8 7.1l1.3-1.5c.8.7 1.7 1 2.7 1 .6 0 1-.2 1-.6 0-.4-.3-.5-1.4-.8-1.8-.4-3.1-.9-3.1-2.6 0-1.5 1.2-2.7 3.2-2.7 1.4 0 2.5.4 3.4 1.1l-1.2 1.6c-.8-.5-1.6-.8-2.3-.8-.6 0-.8.2-.8.5 0 .4.3.5 1.4.8 1.9.4 3.1 1 3.1 2.6 0 1.7-1.3 2.7-3.4 2.7-1.5.1-2.9-.4-3.9-1.3z" fill="#FFF"/></g></svg>