Update Code to 1.136.1 (#7981)

* Update Code to 1.136.1

* Do not click on tab during test file opens

It will already be the selected tab, and if any other tab is already
open (like the welcome tab), it will click that instead.

We disable the welcome page so this is not supposed to actually matter,
but that Setting appears not to be working.

Also add the quick input widget selector in the disabled downloads test,
since if the widget never shows up it would mistakenly pass.

Author: cdrci

CHANGELOG.md

@@ -22,6 +22,12 @@ Code v99.99.999
 
 ## Unreleased
 
+Code v1.136.1
+
+### Changed
+
+- Update to Code 1.136.1
+
 ## [4.135.0](https://github.com/coder/code-server/releases/tag/v4.135.0) - 2026-08-27
 
 Code v1.135.0

lib/vscode

@@ -12,15 +12,15 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -24,6 +24,7 @@ export const serverOptions: OptionDescri
+@@ -40,6 +40,7 @@ export const serverOptions: OptionDescri
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
  	'link-protection-trusted-domains': { type: 'string[]' },
 +	'app-name': { type: 'string' },
 
  	/* ----- server setup ----- */
 
-@@ -124,6 +125,7 @@ export interface ServerParsedArgs {
+@@ -140,6 +141,7 @@ export interface ServerParsedArgs {
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
  	'link-protection-trusted-domains'?: string[],
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -362,8 +362,11 @@ export class WebClientServer {
+@@ -407,8 +407,11 @@ export class WebClientServer {
  			linkProtectionTrustedDomains.push(...this._productService.linkProtectionTrustedDomains);
  		}
 

patches/app-name.diff

@@ -36,8 +36,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
 
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -27,9 +27,9 @@
- 		<meta id="vscode-workbench-builtin-extensions" data-settings="{{WORKBENCH_BUILTIN_EXTENSIONS}}">
+@@ -29,9 +29,9 @@
+ 		<meta id="vscode-workbench-css-modules" data-settings="{{WORKBENCH_DEV_CSS_MODULES}}">
 
  		<!-- Workbench Icon/Manifest/CSS -->
 -		<link rel="icon" href="/_static/src/browser/media/favicon-dark-support.svg" />
@@ -49,15 +49,15 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  		<style id="vscode-css-modules" type="text/css" media="screen"></style>
 
  	</head>
-@@ -39,7 +39,7 @@
+@@ -41,7 +41,7 @@
 
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script>
--		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
-+		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+-		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
++		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script>
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
 Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.html
@@ -73,7 +73,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -24,9 +24,9 @@
+@@ -25,9 +25,9 @@
  		<meta id="vscode-workbench-auth-session" data-settings="{{WORKBENCH_AUTH_SESSION}}">
 
  		<!-- Workbench Icon/Manifest/CSS -->
@@ -86,15 +86,15 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  		<link rel="stylesheet" href="{{WORKBENCH_WEB_BASE_URL}}/out/vs/code/browser/workbench/workbench.css">
 
  	</head>
-@@ -36,7 +36,7 @@
+@@ -37,7 +37,7 @@
 
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script>
--		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
-+		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+-		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
++		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script>
+ 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
 Index: code-server/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
@@ -111,21 +111,31 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -263,7 +263,9 @@ export class WebClientServer {
+@@ -146,7 +146,7 @@ export function createWorkbenchContentSe
+ 		'default-src \'self\';',
+ 		'img-src \'self\' https: data: blob:;',
+ 		'media-src \'self\';',
+-		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
++		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
+ 		'child-src \'self\';',
+ 		`frame-src 'self' https://*.vscode-cdn.net data:;`,
+ 		'worker-src \'self\' data: blob:;',
+@@ -307,8 +307,10 @@ export class WebClientServer {
  		};
 
  		// Prefix routes with basePath for clients
--		const basePath = getFirstHeader('x-forwarded-prefix') || this._basePath;
 +		const rootBase = relativeRoot(getOriginalUrl(req))
 +		const vscodeBase = relativePath(getOriginalUrl(req))
-+		const basePath = vscodeBase || getFirstHeader('x-forwarded-prefix') || this._basePath;
+ 		const forwardedPrefix = getFirstHeader('x-forwarded-prefix');
+-		const basePath = forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath;
++		const basePath = vscodeBase || (forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath);
 
  		const queryConnectionTokens = parsedUrl.searchParams.getAll(connectionTokenQueryName);
  		if (queryConnectionTokens.length === 1) {
-@@ -300,10 +302,14 @@ export class WebClientServer {
+@@ -345,10 +347,14 @@ export class WebClientServer {
  		};
 
- 		const useTestResolver = (!this._environmentService.isBuilt && this._environmentService.args['use-test-resolver']);
+ 		const useTestResolver = (!this._environmentService.isBuilt && !!this._environmentService.args['use-test-resolver']);
 +		// For now we are getting the remote authority from the client to avoid
 +		// needing specific configuration for reverse proxies to work.  Set this to
 +		// something invalid to make sure we catch code that is using this value
@@ -138,35 +148,26 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		);
  		if (!remoteAuthority) {
  			return serveError(req, res, 400, `Bad request.`);
-@@ -350,6 +356,7 @@ export class WebClientServer {
+@@ -395,6 +401,7 @@ export class WebClientServer {
 
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
 +			rootEndpoint: rootBase,
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,
  			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
-@@ -399,7 +406,9 @@ export class WebClientServer {
- 			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
+@@ -446,7 +453,9 @@ export class WebClientServer {
  			WORKBENCH_WEB_BASE_URL: staticRoute,
  			WORKBENCH_NLS_URL,
--			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`
-+			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
+ 			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
+-			WORKBENCH_SCRIPT_NONCE: scriptNonce
++			WORKBENCH_SCRIPT_NONCE: scriptNonce,
 +			BASE: rootBase,
 +			VS_BASE: basePath,
  		};
 
  		// DEV ---------------------------------------------------------------------------------------
-@@ -436,7 +445,7 @@ export class WebClientServer {
- 			'default-src \'self\';',
- 			'img-src \'self\' https: data: blob:;',
- 			'media-src \'self\';',
--			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
-+			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
- 			'child-src \'self\';',
- 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
- 			'worker-src \'self\' data: blob:;',
-@@ -509,3 +518,70 @@ export class WebClientServer {
+@@ -542,3 +551,70 @@ export class WebClientServer {
  		return void res.end(data);
  	}
  }

patches/base-path.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -417,6 +417,9 @@ export async function setupServerService
+@@ -418,6 +418,9 @@ export async function setupServerService
 
  		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
 
@@ -161,7 +161,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  import { CharCode } from '../../base/common/charCode.js';
  import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
  import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -397,14 +398,22 @@ export class WebClientServer {
+@@ -442,14 +443,22 @@ export class WebClientServer {
  		};
 
  		const cookies = cookie.parse(req.headers.cookie || '');
@@ -171,7 +171,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		let WORKBENCH_NLS_URL: string;
  		if (!locale.startsWith('en') && this._productService.nlsCoreBaseUrl) {
  			WORKBENCH_NLS_BASE_URL = this._productService.nlsCoreBaseUrl;
- 			WORKBENCH_NLS_URL = `${WORKBENCH_NLS_BASE_URL}${this._productService.commit}/${this._productService.version}/${locale}/nls.messages.js`;
+ 			WORKBENCH_NLS_URL = createNlsUrl(WORKBENCH_NLS_BASE_URL, this._productService.commit, this._productService.version, locale);
  		} else {
 -			WORKBENCH_NLS_URL = ''; // fallback will apply
 +			try {
@@ -181,24 +181,24 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 +					: '';
 +			} catch (error) {
 +				console.error("Failed to generate translations", error);
-+				WORKBENCH_NLS_URL = '';
++				WORKBENCH_NLS_URL = ''; // fallback will apply
 +			}
  		}
 
- 		const values: { [key: string]: string } = {
+ 		const scriptNonce = createScriptNonce();
 Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -22,6 +22,7 @@ export const serverOptions: OptionDescri
+@@ -38,6 +38,7 @@ export const serverOptions: OptionDescri
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
 +	'locale': { type: 'string' },
 
  	/* ----- server setup ----- */
 
-@@ -120,6 +121,7 @@ export interface ServerParsedArgs {
+@@ -136,6 +137,7 @@ export interface ServerParsedArgs {
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,

patches/display-language.diff

@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -19,6 +19,8 @@ export const serverOptions: OptionDescri
+@@ -35,6 +35,8 @@ export const serverOptions: OptionDescri
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
  	'auth': { type: 'string' },
@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 
  	/* ----- server setup ----- */
 
-@@ -114,6 +116,8 @@ export interface ServerParsedArgs {
+@@ -130,6 +132,8 @@ export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
  	'auth'?: string;
@@ -112,7 +112,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -380,6 +380,8 @@ export class WebClientServer {
+@@ -425,6 +425,8 @@ export class WebClientServer {
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
  			userDataPath: this._environmentService.userDataPath,

patches/external-file-actions.diff

@@ -181,15 +181,15 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -21,6 +21,7 @@ export const serverOptions: OptionDescri
+@@ -37,6 +37,7 @@ export const serverOptions: OptionDescri
  	'auth': { type: 'string' },
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
 +	'disable-getting-started-override': { type: 'boolean' },
 
  	/* ----- server setup ----- */
 
-@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
+@@ -134,6 +135,7 @@ export interface ServerParsedArgs {
  	'auth'?: string;
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
@@ -201,7 +201,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -384,6 +384,7 @@ export class WebClientServer {
+@@ -429,6 +429,7 @@ export class WebClientServer {
  			userDataPath: this._environmentService.userDataPath,
  			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
  			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],