dsh-code-server-app 0.1.32 → 0.1.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.1.32",
+  "version": "0.1.37",
   "description": "Integrate code-server (VS Code in the browser) into DSH Web and Desktop: right-sidebar tab (DSH >= 0.1.5-alpha.1) with a floating-ball fallback for older hosts, over the Connection /api channel (ctx.connection.fetch; no webServer dependency) with host-side process lifecycle.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
@@ -40,27 +40,75 @@
   "files": [
     "lib/index.js",
     "lib/client.js",
+    "lib/vendor.js",
+    "lib/native.js",
     "assets/favicon.ico",
     "assets/favicon.svg",
     "assets/extensions/dshcs-open-file",
-    "scripts/setup-code-server.mjs",
+    "scripts/vendor-code-server.mjs",
+    "scripts/vendor-code-server-pkg.mjs",
+    "scripts/vendor-repacks.mjs",
+    "vendor/VENDOR.json",
     "cordis.patch.yml",
     "LICENSE",
     "README.md",
     "README.en.md"
   ],
-  "scripts": {
-    "setup:code-server": "node scripts/setup-code-server.mjs",
-    "build:client": "node scripts/build-client.mjs"
-  },
   "devDependencies": {
     "esbuild": "^0.25.0",
     "motion": "^12.0.0"
   },
   "license": "MIT",
-  "allowScripts": {
-    "code-server": false,
-    "argon2": true,
-    "unrs-resolver": true
+  "dependencies": {
+    "@microsoft/1ds-core-js": "3.2.13",
+    "@microsoft/1ds-post-js": "3.2.13",
+    "@vscode/iconv-lite-umd": "0.7.1",
+    "@vscode/ripgrep-universal": "1.18.0",
+    "@vscode/sandbox-runtime": "0.0.1",
+    "@vscode/tree-sitter-wasm": "0.3.1",
+    "@vscode/vscode-languagedetection": "1.0.23",
+    "@xterm/addon-clipboard": "0.3.0-beta.301",
+    "@xterm/addon-image": "0.10.0-beta.299",
+    "@xterm/addon-ligatures": "0.11.0-beta.299",
+    "@xterm/addon-progress": "0.3.0-beta.299",
+    "@xterm/addon-search": "0.17.0-beta.299",
+    "@xterm/addon-serialize": "0.15.0-beta.299",
+    "@xterm/addon-unicode11": "0.10.0-beta.299",
+    "@xterm/addon-webgl": "0.20.0-beta.298",
+    "@xterm/headless": "6.1.0-beta.301",
+    "@xterm/xterm": "6.1.0-beta.302",
+    "cookie": "0.7.2",
+    "detect-libc": "2.1.2",
+    "http-proxy-agent": "7.0.0",
+    "https-proxy-agent": "7.0.2",
+    "jschardet": "3.1.4",
+    "katex": "0.16.22",
+    "minimist": "1.2.8",
+    "node-addon-api": "6.1.0",
+    "tar": "7.5.22",
+    "tas-client": "0.4.3",
+    "typescript": "6.0.3",
+    "vscode-oniguruma": "1.7.0",
+    "vscode-regexpp": "3.1.0",
+    "vscode-textmate": "9.3.2",
+    "ws": "8.21.0",
+    "yauzl": "3.3.1",
+    "yazl": "2.4.3",
+    "zod": "4.4.3"
+  },
+  "optionalDependencies": {
+    "@jinsiyu/dsh-code-server-runtime-win32-arm64": "^0.1.37",
+    "@jinsiyu/dsh-code-server-runtime-win32-x64": "^0.1.37",
+    "@jinsiyu/dshcs-code-server-win32-arm64": "4.136.2",
+    "@jinsiyu/dshcs-code-server-win32-x64": "4.136.2"
+  },
+  "scripts": {
+    "vendor:code-server": "node scripts/vendor-code-server.mjs",
+    "vendor:latest": "node scripts/vendor-code-server.mjs --force",
+    "vendor:check": "node scripts/vendor-code-server.mjs --check",
+    "repack:build": "node scripts/vendor-repacks.mjs",
+    "repack:code-server": "node scripts/vendor-code-server-pkg.mjs",
+    "publish:repacks": "node scripts/publish-repacks.mjs",
+    "build:client": "node scripts/build-client.mjs"
   }
-}
+}

package/scripts/vendor-code-server-pkg.mjs

@@ -0,0 +1,137 @@
+// scripts/vendor-code-server-pkg.mjs — 把内置 code-server 树打成**平台专属子包**。
+//
+// 产物(每个目标一个,os/cpu 限定):
+//   repack/build/code-server-<target>/
+//     package.json                  @jinsiyu/dshcs-code-server-<target>@<code-server 版本>
+//     code-server/**                完整 code-server 树(out/ + lib/vscode + 自带的 136 个依赖)
+//
+// 为什么要放在子目录 code-server/ 而不是包根:npm/pnpm 打包**永远排除包根目录的 node_modules**,
+// 放在被 files 覆盖的子目录里才会随包发布(主包 0.1.36 用的就是同一招)。
+//
+// 为什么子包不写 dependencies:那 136 个依赖已经作为文件打包在 code-server/node_modules 里,
+// 写成 dependencies 会让 pnpm 再去 registry 装一份。留着 `dependencies` 字段的是嵌套的
+// code-server/package.json(它只是普通文件,不被解析)。
+//
+// 平台差异只有 argon2 的原生二进制(win32-arm64 上游无预编译 → 打包期编译;
+// win32-x64 用 `node-gyp rebuild --arch=x64` 现编,并校验 PE machine)。
+//
+// 用法:
+//   node scripts/vendor-code-server-pkg.mjs [--target win32-arm64,win32-x64] [--pack]
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = resolve(here, '..');
+const repackDir = join(pkgRoot, 'repack');
+const buildDir = join(repackDir, 'build');
+const tgzDir = join(repackDir, 'tgz');
+const vendorTree = join(pkgRoot, 'vendor', 'code-server');
+const npmCache = join(pkgRoot, '.npm-cache');
+
+const argv = process.argv.slice(2);
+const DO_PACK = argv.includes('--pack');
+const TARGETS = (() => {
+  const i = argv.indexOf('--target');
+  if (i < 0 || argv[i + 1] === undefined) return [`${process.platform}-${process.arch}`];
+  return argv[i + 1].split(',').map((s) => s.trim()).filter(Boolean);
+})();
+
+const readJson = (p) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } };
+
+function npm(args, cwd) {
+  const cli = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  const env = { ...process.env, npm_config_cache: npmCache, npm_config_update_notifier: 'false' };
+  const hasCli = existsSync(cli);
+  const cmd = hasCli ? process.execPath : (process.platform === 'win32' ? 'npm.cmd' : 'npm');
+  const full = hasCli ? [cli, ...args] : args;
+  const res = spawnSync(cmd, full, { cwd, shell: !hasCli && process.platform === 'win32', env, stdio: 'inherit' });
+  if ((res.status ?? 1) !== 0) throw new Error(`npm ${args.join(' ')} failed (${res.status})`);
+}
+
+/** PE machine(0x8664=x64 / 0xaa64=arm64),用于交叉编译后的静态校验。 */
+function peMachine(file) {
+  try {
+    const b = readFileSync(file);
+    if (b[0] !== 0x4d || b[1] !== 0x5a) return null;
+    const off = b.readUInt32LE(0x3c);
+    if (b.toString('ascii', off, off + 4) !== 'PE\u0000\u0000') return null;
+    return `0x${b.readUInt16LE(off + 4).toString(16)}`;
+  } catch { return null; }
+}
+
+/** 为某个目标编译 argon2 原生模块(就地覆盖包内 build/Release/argon2.node)。 */
+function buildArgon2(tree, arch) {
+  const argon2 = join(tree, 'node_modules', 'argon2');
+  if (!existsSync(join(argon2, 'binding.gyp'))) throw new Error(`argon2 不在位: ${argon2}`);
+  console.log(`[cs-pkg] 编译 argon2 (--arch=${arch}) …`);
+  const ng = join(process.env.APPDATA ?? '', 'npm', 'node_modules', 'node-gyp', 'bin', 'node-gyp.js');
+  const cli = existsSync(ng) ? ng : null;
+  if (cli === null) throw new Error('找不到 node-gyp(需全局安装 node-gyp)');
+  const res = spawnSync(process.execPath, [cli, 'rebuild', `--arch=${arch}`], { cwd: argon2, stdio: 'inherit' });
+  if ((res.status ?? 1) !== 0) throw new Error(`argon2 编译失败 (${res.status})`);
+  const bin = join(argon2, 'build', 'Release', 'argon2.node');
+  if (!existsSync(bin)) throw new Error(`argon2 编译产物缺失: ${bin}`);
+  return bin;
+}
+
+function main() {
+  if (!existsSync(join(vendorTree, 'out', 'node', 'entry.js'))) {
+    throw new Error('缺少 vendor/code-server;先运行 `node scripts/vendor-code-server.mjs`');
+  }
+  const csVersion = readJson(join(vendorTree, 'package.json'))?.version;
+  if (typeof csVersion !== 'string') throw new Error('读不到 code-server 版本');
+  const pluginPkg = readJson(join(pkgRoot, 'package.json'));
+  const scope = '@jinsiyu';
+  const hostKey = `${process.platform}-${process.arch}`;
+  const plan = [];
+
+  for (const target of TARGETS) {
+    const [platform, arch] = target.split('-');
+    if (platform === undefined || arch === undefined) throw new Error(`--target 需要 <platform>-<arch>,收到 ${target}`);
+    const outName = `code-server-${target}`;
+    const dir = join(buildDir, outName);
+    rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir, { recursive: true });
+    console.log(`[cs-pkg] 复制 vendor/code-server → ${relative(pkgRoot, join(dir, 'code-server'))}`);
+    cpSync(vendorTree, join(dir, 'code-server'), { recursive: true, dereference: false, maxRetries: 6, retryDelay: 250 });
+
+    const tree = join(dir, 'code-server');
+    // 目标架构的 argon2 原生二进制
+    const wantMachine = arch === 'x64' ? '0x8664' : arch === 'arm64' ? '0xaa64' : null;
+    const have = join(tree, 'node_modules', 'argon2', 'build', 'Release', 'argon2.node');
+    if (target !== hostKey) {
+      const bin = buildArgon2(tree, arch);
+      const m = peMachine(bin);
+      if (wantMachine !== null && m !== wantMachine) throw new Error(`argon2 PE machine=${m},期望 ${wantMachine}`);
+      console.log(`[cs-pkg] argon2 → ${relative(pkgRoot, bin)} (${m})`);
+    } else {
+      console.log(`[cs-pkg] argon2 沿用本机产物 (${peMachine(have) ?? '?'})`);
+    }
+
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({
+      name: `${scope}/dshcs-code-server-${target}`,
+      version: csVersion,
+      description: `Bundled code-server ${csVersion} tree for ${target} (out/ + lib/vscode + its ${readdirSync(join(tree, 'node_modules')).length} runtime deps), repacked so pnpm installs it without any build script.`,
+      os: [platform],
+      cpu: [arch],
+      files: ['code-server'],
+      license: 'MIT',
+      repository: pluginPkg?.repository ?? undefined,
+    }, null, 2) + '\n', 'utf8');
+    plan.push({ dir, file: `${`${scope}/dshcs-code-server-${target}`.replace(/^@/, '').replaceAll('/', '-')}-${csVersion}.tgz` });
+  }
+
+  if (DO_PACK) {
+    mkdirSync(tgzDir, { recursive: true });
+    for (const item of plan) {
+      console.log(`[cs-pkg] npm pack ${item.file}`);
+      npm(['pack', '--pack-destination', tgzDir], item.dir);
+    }
+  }
+  console.log(`[cs-pkg] 完成:${plan.length} 个平台子包 → repack/build/${DO_PACK ? ' + repack/tgz/' : ''}`);
+  console.log('[cs-pkg] 下一步:`node scripts/publish-repacks.mjs --only dshcs-code-server` 发布(或用 --dry-run 预览)');
+}
+
+main();

package/scripts/vendor-code-server.mjs

@@ -0,0 +1,293 @@
+// scripts/vendor-code-server.mjs — 打包期准备插件包内置的 code-server 本体。
+//
+// 产物:
+//   vendor/code-server/   code-server 本体 + 它自己的运行时依赖
+//                         (npm install code-server@<v> --ignore-scripts;argon2 补齐原生二进制);
+//                         **不含** VS Code 内部依赖(lib/vscode/node_modules,约 1GB),
+//                         那部分由包管理器按依赖安装(见 scripts/vendor-repacks.mjs);
+//   vendor/VENDOR.json    版本与来源元数据。
+//
+// 为什么 code-server 本体随包发布而不是写成依赖:pnpm 11 只接受宿主 profile 的构建许可,
+// code-server / argon2 / unrs-resolver 带安装脚本 → 直接进 dependencies 会让
+// `dsh plugin add` 报 [ERR_PNPM_IGNORED_BUILDS] exit 1。
+//
+// 用法:
+//   node scripts/vendor-code-server.mjs --check                 # 只报告内置版本 vs npm 最新版
+//   node scripts/vendor-code-server.mjs --force                 # 重建为 npm 最新版
+//   node scripts/vendor-code-server.mjs --version 4.136.2       # 指定版本
+//   node scripts/vendor-code-server.mjs --from <code-server 树>  # 从已准备好的树快照(最快)
+//   DSHCS_ARGON2_BINARY=<argon2.node>                           # 编译不可用时复用已有原生二进制
+//
+// 换 code-server 版本后:还要重跑 `node scripts/vendor-repacks.mjs …` 更新预编译原生包,
+// 再 `npm run publish:repacks` 发布,最后 bump 版本并 `pnpm pack`。
+import { spawnSync } from 'node:child_process';
+import { cpSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { homedir } from 'node:os';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = resolve(here, '..');
+const vendorDir = join(pkgRoot, 'vendor');
+const vendorTree = join(vendorDir, 'code-server');
+// 临时目录与 npm 缓存都放在工作区内:本机沙箱下 ~\AppData\Local\npm-cache 不可写(EPERM)。
+const workRoot = join(pkgRoot, '.vendor-tmp');
+const npmCache = join(pkgRoot, '.npm-cache');
+
+function argValues(name) {
+  const out = [];
+  for (let i = 0; i < process.argv.length - 1; i += 1) {
+    if (process.argv[i] !== name) continue;
+    for (const part of String(process.argv[i + 1]).split(',')) {
+      const v = part.trim();
+      if (v !== '') out.push(v);
+    }
+  }
+  return out;
+}
+function argValue(name) {
+  const all = argValues(name);
+  return all.length > 0 ? all[all.length - 1] : null;
+}
+const FORCE = process.argv.includes('--force');
+const FROM = argValue('--from');
+const PINNED = argValue('--version') || process.env.DSHCS_CODE_SERVER_VERSION || null;
+
+function run(cmd, args, cwd, extraEnv) {
+  // 只有 .cmd/.bat 需要 shell;node.exe 走 shell 会因路径带空格被 cmd 拆开(实测)。
+  const useShell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(cmd);
+  console.log(`[vendor] $ ${cmd} ${args.join(' ')}${cwd ? `  (cwd=${cwd})` : ''}`);
+  const res = spawnSync(cmd, args, {
+    cwd,
+    stdio: 'inherit',
+    shell: useShell,
+    env: extraEnv ? { ...process.env, ...extraEnv } : process.env,
+  });
+  if (res.status !== 0) throw new Error(`${cmd} ${args.join(' ')} failed (${res.status})`);
+}
+
+/** npm 优先直调 npm-cli.js(避免 shell 引号问题);找不到再回退 npm.cmd。 */
+function npm(args, cwd) {
+  const env = { npm_config_cache: npmCache, npm_config_update_notifier: 'false' };
+  const cli = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  if (existsSync(cli)) run(process.execPath, [cli, ...args], cwd, env);
+  else run(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, cwd, env);
+}
+
+async function latestVersion() {
+  const res = await fetch('https://registry.npmjs.org/code-server/latest');
+  if (!res.ok) throw new Error(`registry responded ${res.status}`);
+  const json = await res.json();
+  if (typeof json.version !== 'string') throw new Error('registry payload has no version');
+  return json.version;
+}
+
+function readManifest(file) {
+  try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return null; }
+}
+function readTreeVersion(tree) {
+  const m = readManifest(join(tree, 'package.json'));
+  return m !== null && typeof m.version === 'string' ? m.version : null;
+}
+
+/** 递归目录体积(MB),仅用于日志。 */
+function sizeMB(dir) {
+  let total = 0;
+  const stack = [dir];
+  while (stack.length > 0) {
+    const cur = stack.pop();
+    let entries;
+    try { entries = readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+    for (const ent of entries) {
+      if (ent.isDirectory()) stack.push(join(cur, ent.name));
+      else if (ent.isFile()) { try { total += statSync(join(cur, ent.name)).size; } catch { /* ignore */ } }
+    }
+  }
+  return Math.round((total / 1024 / 1024) * 10) / 10;
+}
+
+/** 补齐 code-server 自己的 argon2 native(win32-arm64 无预编译)。 */
+function ensureArgon2(tree) {
+  const argon2 = join(tree, 'node_modules', 'argon2');
+  if (!existsSync(argon2)) return;
+  const probe = probeArgon2(argon2);
+  if (probe.ok) {
+    console.log(`[vendor] argon2 native 就绪(${probe.via})`);
+    return;
+  }
+  let built = false;
+  const ngb = findNgb(tree);
+  if (ngb !== null) {
+    try {
+      console.log(`[vendor] argon2 native 缺失(${probe.error}),执行 node-gyp-build…`);
+      run(process.execPath, [ngb, argon2], tree);
+      built = probeArgon2(argon2).ok;
+    } catch (e) {
+      console.warn(`[vendor] node-gyp-build 失败:${e.message}`);
+    }
+  }
+  if (!built) {
+    const bin = findArgon2Binary();
+    if (bin === null) {
+      throw new Error('argon2 native 不可用:编译失败且未找到可复用二进制'
+        + '(可在有工具链的机器上重跑,或用 DSHCS_ARGON2_BINARY 指定 argon2.node)');
+    }
+    const dst = join(argon2, 'build', 'Release');
+    rmSync(join(argon2, 'build'), { recursive: true, force: true });
+    mkdirSync(dst, { recursive: true });
+    copyFileSync(bin, join(dst, 'argon2.node'));
+    console.log(`[vendor] argon2 native ← 复用 ${bin}`);
+  }
+}
+
+/** 可复用的 argon2.node:环境变量 → 本机 DSH profile 里已装好的安装 → 插件包内既有产物。 */
+function findArgon2Binary() {
+  const cands = [];
+  if (typeof process.env.DSHCS_ARGON2_BINARY === 'string' && process.env.DSHCS_ARGON2_BINARY !== '') {
+    cands.push(process.env.DSHCS_ARGON2_BINARY);
+  }
+  try {
+    const profiles = join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'profiles');
+    if (existsSync(profiles)) {
+      for (const name of readdirSync(profiles)) {
+        // 0.1.35 及更早的安装位
+        cands.push(join(profiles, name, '.code-server-app', 'node_modules', 'code-server',
+          'node_modules', 'argon2', 'build', 'Release', 'argon2.node'));
+        // 0.1.36+ 就地安装位
+        cands.push(join(profiles, name, 'node_modules', 'dsh-code-server-app', 'vendor', 'code-server',
+          'node_modules', 'argon2', 'build', 'Release', 'argon2.node'));
+      }
+    }
+  } catch { /* ignore */ }
+  cands.push(join(vendorTree, 'node_modules', 'argon2', 'build', 'Release', 'argon2.node'));
+  cands.push(join(pkgRoot, 'node_modules', 'code-server', 'node_modules', 'argon2', 'build', 'Release', 'argon2.node'));
+  for (const c of cands) if (existsSync(c)) return c;
+  return null;
+}
+
+function findNgb(tree) {
+  const cands = [
+    join(tree, 'node_modules', 'node-gyp-build', 'bin.js'),
+    join(tree, 'node_modules', 'argon2', 'node_modules', 'node-gyp-build', 'bin.js'),
+  ];
+  for (const c of cands) if (existsSync(c)) return c;
+  return null;
+}
+
+function probeArgon2(dir) {
+  const via = [];
+  if (existsSync(join(dir, 'build', 'Release', 'argon2.node'))) via.push('build/Release');
+  const want = `${process.platform}-${process.arch}`;
+  if (existsSync(join(dir, 'prebuilds', want))) via.push(`prebuilds/${want}`);
+  if (via.length > 0) return { ok: true, via: via.join('+') };
+  // 不 require:argon2 的 index.js 会触发 node-gyp-build 现场编译(慢且可能失败)。
+  return { ok: false, error: `无 build/Release 也无 prebuilds/${want}` };
+}
+
+/** 去掉 vendored 包里的安装脚本(pnpm/npm 不读它们,但避免后人误以为会执行)。 */
+function stripInstallScripts(tree) {
+  const targets = [
+    join(tree, 'package.json'),
+    join(tree, 'node_modules', 'argon2', 'package.json'),
+    join(tree, 'node_modules', 'unrs-resolver', 'package.json'),
+  ];
+  for (const file of targets) {
+    if (!existsSync(file)) continue;
+    try {
+      const manifest = readManifest(file);
+      if (manifest !== null && manifest.scripts
+        && (manifest.scripts.preinstall || manifest.scripts.install || manifest.scripts.postinstall)) {
+        delete manifest.scripts.preinstall;
+        delete manifest.scripts.install;
+        delete manifest.scripts.postinstall;
+        writeFileSync(file, JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+        console.log(`[vendor] 已剥离安装脚本: ${manifest.name}`);
+      }
+    } catch (e) {
+      console.warn(`[vendor] 剥离脚本失败(${file}): ${e.message}`);
+    }
+  }
+}
+
+/** 复制 code-server 本体到 vendor/code-server;跳过 VS Code 内部依赖目录(不进主包)。 */
+function copyCodeServer(src, dest) {
+  rmSync(dest, { recursive: true, force: true });
+  mkdirSync(dirname(dest), { recursive: true });
+  const inner = [
+    join('lib', 'vscode', 'node_modules'),
+    join('lib', 'vscode', 'extensions', 'node_modules'),
+  ].map((p) => p.replaceAll('\\', '/'));
+  cpSync(src, dest, {
+    recursive: true,
+    dereference: false,
+    maxRetries: 6,
+    retryDelay: 250,
+    filter: (source) => {
+      const rel = source.slice(src.length + 1).replaceAll('\\', '/');
+      return !inner.some((p) => rel === p || rel.startsWith(p + '/'));
+    },
+  });
+}
+
+async function main() {
+  const existing = readTreeVersion(vendorTree);
+
+  // --check:只报告内置版本 vs npm 最新版,不改任何东西。
+  if (process.argv.includes('--check')) {
+    const latest = await latestVersion();
+    console.log(`[vendor] 内置 code-server: ${existing ?? '(无)'} | npm latest: ${latest}`);
+    console.log(existing === latest
+      ? '[vendor] 已是最新,无需重建'
+      : '[vendor] 有新版本:pnpm run vendor:latest → node scripts/vendor-repacks.mjs → pnpm run publish:repacks → 版本 +1 后 pnpm pack');
+    return;
+  }
+
+  const upToDate = existing !== null && !FORCE && FROM === null && PINNED === null;
+  let codeServerVersion = existing;
+  let sourceKind = 'registry';
+
+  if (upToDate) {
+    console.log(`[vendor] vendor/code-server 已存在(code-server@${existing});跳过(用 --force 重建)`);
+  } else if (FROM !== null) {
+    codeServerVersion = readTreeVersion(FROM);
+    if (codeServerVersion === null) throw new Error(`--from ${FROM} 不是一棵 code-server 树`);
+    console.log(`[vendor] 快照 ${FROM} → vendor/code-server (code-server@${codeServerVersion})`);
+    // 只在副本上补 argon2 / 剥脚本,不改动源树(--from 常常指向正在使用的安装)。
+    copyCodeServer(FROM, vendorTree);
+    ensureArgon2(vendorTree);
+    stripInstallScripts(vendorTree);
+    sourceKind = `snapshot:${FROM}`;
+  } else {
+    codeServerVersion = PINNED ?? await latestVersion();
+    console.log(`[vendor] 从 registry 准备 code-server@${codeServerVersion} …`);
+    const tmp = join(workRoot, `source-${process.pid}`);
+    rmSync(tmp, { recursive: true, force: true });
+    mkdirSync(tmp, { recursive: true });
+    try {
+      npm(['install', `code-server@${codeServerVersion}`, '--ignore-scripts', '--omit=dev',
+        '--no-audit', '--no-fund', '--no-save', '--prefix', tmp], tmp);
+      const tree = join(tmp, 'node_modules', 'code-server');
+      if (!existsSync(join(tree, 'out', 'node', 'entry.js'))) throw new Error('code-server 安装不完整');
+      ensureArgon2(tree);
+      stripInstallScripts(tree);
+      copyCodeServer(tree, vendorTree);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  }
+
+  const meta = {
+    codeServerVersion,
+    preparedAt: new Date().toISOString(),
+    source: sourceKind,
+    node: process.version,
+    platform: process.platform,
+    arch: process.arch,
+    sizeMB: sizeMB(vendorTree),
+  };
+  writeFileSync(join(vendorDir, 'VENDOR.json'), JSON.stringify(meta, null, 2) + '\n', 'utf8');
+  console.log(`[vendor] 完成:vendor/code-server (code-server@${codeServerVersion}, ${meta.sizeMB} MB) + vendor/VENDOR.json`);
+  console.log('[vendor] 提示:VS Code 内部依赖由包管理器安装;换版本后请重跑 scripts/vendor-repacks.mjs 更新预编译原生包');
+}
+
+await main();