dsh-code-server-app 0.1.42 → 0.2.0

package/lib/launcher.mjs

@@ -0,0 +1,313 @@
+/**
+ * lib/launcher.mjs — VS Code server 的最小启动器(取代 code-server 的 out/node/** 服务层)。
+ *
+ * 它在**子进程**里加载 <tree>/lib/vscode/out/server-main.js,自建 node:http 把请求交给
+ * VS Code 的 handleRequest/handleUpgrade,并补齐 code-server 原先负责的少量 HTTP 面:
+ *   /healthz           就绪探针(host 轮询;也回传最近一次 upgrade 路径,便于排障)
+ *   /manifest.json     PWA manifest(VS Code server 不提供)
+ *   /_static/*         浏览器静态资源(favicon / PWA 图标 / serviceWorker.js)
+ *   /proxy/:port/…     转发端口 HTTP 代理(Ports 面板;WS 版仅在 loopback 模式可用)
+ *
+ * 为什么是独立进程:VS Code 的 server 会改进程全局(win32 下 import 即 chdir、覆盖
+ * Error.stackTraceLimit、注册 SIGPIPE、patch Module._resolveLookupPaths、多处 process.exit),
+ * 且 node-pty/sqlite 崩溃时必须只带走 IDE,不能带走 DSH host。
+ *
+ * 用法(由 lib/index.js 调用,不面向用户):
+ *   node lib/launcher.mjs --tree <VS Code 树根> --user-data-dir <dir> --extensions-dir <dir> \
+ *        (--port <n> [--host 127.0.0.1] | --pipe <\\.\pipe\name|unix socket>) \
+ *        [--parent-pid <pid>] [--locale zh-cn]
+ *
+ * 就绪信号:stdout 打印 `dshcs-ready <productPath> <mode> <addr>`。
+ */
+
+import { createServer as createHttpServer, request as httpRequest } from 'node:http';
+import { createReadStream, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { connect } from 'node:net';
+import { dirname, extname, join, normalize, resolve, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = resolve(HERE, '..');
+
+// ---------------------------------------------------------------- 参数
+
+function parseArgs(argv) {
+  const out = {
+    tree: process.env.DSHCS_VS_ROOT ?? null,
+    userDataDir: null,
+    extensionsDir: null,
+    host: '127.0.0.1',
+    port: null,
+    pipe: null,
+    parentPid: null,
+    locale: null,
+    disableProxy: false,
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--tree') out.tree = argv[++i];
+    else if (a === '--user-data-dir') out.userDataDir = argv[++i];
+    else if (a === '--extensions-dir') out.extensionsDir = argv[++i];
+    else if (a === '--host') out.host = argv[++i];
+    else if (a === '--port') out.port = Number(argv[++i]);
+    else if (a === '--pipe') out.pipe = argv[++i];
+    else if (a === '--parent-pid') out.parentPid = Number(argv[++i]);
+    else if (a === '--locale') out.locale = argv[++i];
+    else if (a === '--disable-proxy') out.disableProxy = true;
+  }
+  return out;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const log = (...parts) => console.log('[dshcs-launcher]', ...parts);
+const fail = (message) => { console.error('[dshcs-launcher] FATAL', message); process.exit(2); };
+
+if (args.tree === null) fail('缺少 --tree(或环境变量 DSHCS_VS_ROOT)');
+const tree = resolve(args.tree);
+const serverMain = join(tree, 'lib', 'vscode', 'out', 'server-main.js');
+if (!existsSync(serverMain)) fail(`不是一棵 VS Code 树(缺少 ${serverMain})`);
+if (args.pipe === null && !Number.isFinite(args.port)) fail('必须给 --port 或 --pipe');
+
+const userDataDir = resolve(args.userDataDir ?? join(PACKAGE_ROOT, '.dshcs-data', 'user-data'));
+const extensionsDir = resolve(args.extensionsDir ?? join(userDataDir, '..', 'extensions'));
+mkdirSync(userDataDir, { recursive: true });
+mkdirSync(extensionsDir, { recursive: true });
+
+const product = (() => {
+  try { return JSON.parse(readFileSync(join(tree, 'lib', 'vscode', 'product.json'), 'utf8')); } catch { return {}; }
+})();
+const productPath = `${product.quality ?? 'oss'}-${product.commit ?? 'dev'}`;
+
+// ---------------------------------------------------------------- 进程护栏(必须 import 前)
+
+process.env.CODE_SERVER_PARENT_PID ??= String(process.pid);
+process.env.VSCODE_HANDLES_SIGPIPE ??= '1';
+process.env.VSCODE_CWD ??= process.cwd();
+
+let vsServer = null;
+const recentUpgrades = [];
+
+async function loadVscodeServer() {
+  const cwdBefore = process.cwd();
+  const mod = await import(pathToFileURL(serverMain).href);
+  // win32 下 server-main 顶层 DB() 会 chdir 到 dirname(process.execPath),立即复位
+  try { if (process.cwd() !== cwdBefore) process.chdir(cwdBefore); } catch { /* ignore */ }
+  const serverModule = await mod.loadCodeWithNls();
+  const codeArgs = {
+    auth: 'none',
+    'user-data-dir': userDataDir,
+    'extensions-dir': extensionsDir,
+    'accept-server-license-terms': true,
+    compatibility: '1.64',
+    'without-connection-token': true,
+    'disable-telemetry': true,
+    'disable-update-check': true,
+    _: [],
+  };
+  if (args.locale !== null) codeArgs.locale = args.locale;
+  return serverModule.createServer(null, codeArgs);
+}
+
+// ---------------------------------------------------------------- 静态资源(/_static/*)
+
+const MIME = {
+  '.svg': 'image/svg+xml; charset=utf-8',
+  '.ico': 'image/x-icon',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.txt': 'text/plain; charset=utf-8',
+  '.webmanifest': 'application/manifest+json',
+};
+
+function serveTreeStatic(urlPath, res) {
+  const rel = decodeURIComponent(urlPath.replace(/^\/_static\/?/, ''));
+  const full = normalize(join(tree, rel));
+  if (full !== tree && !full.startsWith(tree + sep)) { res.writeHead(403); res.end('forbidden'); return; }
+  let stat;
+  try { stat = statSync(full); } catch { res.writeHead(404); res.end(); return; }
+  if (!stat.isFile()) { res.writeHead(404); res.end(); return; }
+  const headers = {
+    'content-type': MIME[extname(full).toLowerCase()] ?? 'application/octet-stream',
+    'cache-control': 'public, max-age=3600',
+  };
+  if (full.endsWith('serviceWorker.js')) headers['service-worker-allowed'] = '/';
+  res.writeHead(200, headers);
+  createReadStream(full).pipe(res);
+}
+
+function manifestBody() {
+  return JSON.stringify({
+    name: product.nameShort ?? 'code-server',
+    short_name: product.nameShort ?? 'code-server',
+    start_url: '.',
+    display: 'fullscreen',
+    display_override: ['window-controls-overlay'],
+    description: 'Run Code on a remote server.',
+    icons: [192, 512].flatMap((size) => ([
+      { src: `./_static/src/browser/media/pwa-icon-${size}.png`, type: 'image/png', sizes: `${size}x${size}`, purpose: 'any' },
+      { src: `./_static/src/browser/media/pwa-icon-maskable-${size}.png`, type: 'image/png', sizes: `${size}x${size}`, purpose: 'maskable' },
+    ])),
+  }, null, 2);
+}
+
+// ---------------------------------------------------------------- 转发端口代理(/proxy/:port、/absproxy/:port)
+
+const PROXY_RE = /^\/(abs)?proxy\/(\d{1,5})(\/.*)?$/;
+
+function proxyTarget(url) {
+  const m = PROXY_RE.exec(new URL(url, 'http://x').pathname);
+  if (m === null) return null;
+  const port = Number(m[2]);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  const rest = m[3] ?? '/';
+  const search = new URL(url, 'http://x').search;
+  return { port, path: m[1] === 'abs' ? `${rest}${search}` : `${rest}${search}` };
+}
+
+function handleProxy(req, res, target) {
+  const upstream = httpRequest({
+    host: '127.0.0.1',
+    port: target.port,
+    method: req.method,
+    path: target.path,
+    headers: stripHopHeaders(req.headers),
+  }, (upstreamRes) => {
+    res.writeHead(upstreamRes.statusCode ?? 502, upstreamRes.headers);
+    upstreamRes.pipe(res);
+  });
+  upstream.on('error', (error) => {
+    log(`proxy ${target.port} failed: ${error.message}`);
+    if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end(`proxy error: ${error.message}`);
+  });
+  req.pipe(upstream);
+}
+
+function stripHopHeaders(headers) {
+  const out = { ...headers };
+  delete out.connection;
+  delete out['proxy-connection'];
+  return out;
+}
+
+function handleProxyUpgrade(req, socket, head, target) {
+  const upstream = connect({ host: '127.0.0.1', port: target.port }, () => {
+    const lines = [`GET ${target.path} HTTP/1.1`];
+    for (let i = 0; i < req.rawHeaders.length; i += 2) lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+    upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+    if (head.length > 0) upstream.write(head);
+    upstream.pipe(socket);
+    socket.pipe(upstream);
+  });
+  upstream.on('error', (error) => { log(`proxy ws ${target.port} failed: ${error.message}`); socket.destroy(); });
+  socket.on('error', () => upstream.destroy());
+  socket.on('close', () => upstream.destroy());
+}
+
+// ---------------------------------------------------------------- HTTP / WS 分发
+
+const server = createHttpServer((req, res) => {
+  const url = req.url ?? '/';
+  if (url === '/healthz') {
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+    res.end(JSON.stringify({
+      ok: true,
+      productPath,
+      pid: process.pid,
+      mode: args.pipe === null ? 'tcp' : 'pipe',
+      recentUpgrades: recentUpgrades.slice(-3),
+    }));
+    return;
+  }
+  if (url === '/manifest.json') {
+    res.writeHead(200, { 'content-type': 'application/manifest+json; charset=utf-8' });
+    res.end(manifestBody());
+    return;
+  }
+  if (url.startsWith('/_static/')) { serveTreeStatic(url, res); return; }
+  if (!args.disableProxy) {
+    const target = proxyTarget(url);
+    if (target !== null) { handleProxy(req, res, target); return; }
+  }
+  Promise.resolve(vsServer.handleRequest(req, res)).catch((error) => {
+    log(`handleRequest failed: ${error && error.stack ? error.stack : error}`);
+    if (!res.headersSent) res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
+    if (!res.writableEnded) res.end('internal error');
+  });
+});
+
+server.on('upgrade', (req, socket, head) => {
+  const url = req.url ?? '/';
+  recentUpgrades.push(url);
+  if (recentUpgrades.length > 10) recentUpgrades.shift();
+  if (!args.disableProxy) {
+    const target = proxyTarget(url);
+    if (target !== null) { handleProxyUpgrade(req, socket, head, target); return; }
+  }
+  socket.pause();
+  req.ws = socket;
+  req.head = head;
+  try {
+    vsServer.handleUpgrade(req, socket);
+  } catch (error) {
+    log(`handleUpgrade threw: ${error && error.message ? error.message : error}`);
+    socket.destroy();
+  }
+  socket.resume();
+});
+
+// ---------------------------------------------------------------- 生命周期
+
+let shuttingDown = false;
+async function shutdown(reason, code = 0) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  log(`shutting down (${reason})`);
+  try { await vsServer?.dispose?.(); } catch (error) { log(`dispose failed: ${error && error.message}`); }
+  const done = () => process.exit(code);
+  try { server.close(done); } catch { done(); }
+  setTimeout(() => process.exit(code), 3000).unref();
+}
+
+for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => { void shutdown(sig); });
+
+// 父进程(DSH host)消失 → 自行退出,避免留下孤儿 IDE 进程
+if (Number.isFinite(args.parentPid) && args.parentPid > 0) {
+  const parentPid = args.parentPid;
+  const timer = setInterval(() => {
+    try {
+      process.kill(parentPid, 0);
+    } catch (error) {
+      if (error && error.code === 'ESRCH') void shutdown(`parent ${parentPid} gone`);
+    }
+  }, 5000);
+  timer.unref();
+}
+
+// ---------------------------------------------------------------- 启动
+
+try {
+  vsServer = await loadVscodeServer();
+} catch (error) {
+  fail(`加载 VS Code server 失败: ${error && error.stack ? error.stack : error}`);
+}
+
+const listenTarget = args.pipe === null ? { host: args.host, port: args.port } : args.pipe;
+server.on('error', (error) => { fail(`监听失败(${JSON.stringify(listenTarget)}): ${error.message}`); });
+
+server.listen(listenTarget, () => {
+  const addr = server.address();
+  const shown = typeof addr === 'string' ? addr : `${addr.address}:${addr.port}`;
+  log(`listening on ${shown} (tree=${tree})`);
+  log(`user-data-dir=${userDataDir} extensions-dir=${extensionsDir}`);
+  console.log(`dshcs-ready ${productPath} ${args.pipe === null ? 'tcp' : 'pipe'} ${shown}`);
+});
+
+// 兜底:未捕获异常不应静默留下半死进程
+process.on('uncaughtException', (error) => {
+  console.error('[dshcs-launcher] uncaughtException', error && error.stack ? error.stack : error);
+  void shutdown('uncaughtException', 1);
+});

package/lib/native.js

@@ -13,7 +13,7 @@
 //   2. 从 code-server 运行位置出发校验这些模块是否真的能 require 到;
 //   3. 必要时在 code-server 树里补齐别名 junction(ESM import 不认 NODE_PATH,只能靠目录链)。
 import { createRequire } from 'node:module';
-import { existsSync, readFileSync, mkdirSync, symlinkSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync, symlinkSync, lstatSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { PACKAGE_ROOT, codeServerRoot, profileRootOf } from './vendor.js';
 
@@ -163,21 +163,44 @@ export function ensureAliasLinks() {
   return { created, failed };
 }
 
-/** 从**插件依赖图**解析(插件 node_modules → <profile>/node_modules),即包管理器装出来的真实包目录。
+/** 从**插件依赖图**解析(插件 node_modules → <profile>/node_modules),返回**真正的包根目录**
+ *  (有些包 `exports` 不暴露 `./package.json`,只能从入口文件往上找 name 匹配的目录)。
  *  与 `resolveNativeDir` 的区别:不走 code-server 树(树里可能有别的同名版本,例如 code-server 自带的
- *  typescript 5.9.3,而 VS Code 要的是 inner deps 里那份 6.0.3)。 */
-function resolveFromPlugin(name) {
+ *  typescript 5.9.3,而 VS Code 要的是 inner deps 里那份)。 */
+function packageRootFromPlugin(name) {
+  let from;
   try {
-    const from = createRequire(join(PACKAGE_ROOT, 'package.json'));
-    for (const spec of [`${name}/package.json`, name]) {
+    from = createRequire(join(PACKAGE_ROOT, 'package.json'));
+  } catch { return null; }
+  try {
+    return dirname(from.resolve(`${name}/package.json`));
+  } catch { /* exports 未暴露 package.json → 退回入口文件 */ }
+  try {
+    let dir = dirname(from.resolve(name));
+    for (let i = 0; i < 8; i += 1) {
       try {
-        return dirname(from.resolve(spec));
-      } catch { /* 试下一个 */ }
+        const manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+        if (manifest.name === name) return dir;
+      } catch { /* 继续往上 */ }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
     }
-  } catch { /* 忽略 */ }
+  } catch { /* 解析不了 */ }
   return null;
 }
 
+/** 路径上是否已有东西(**包括断链的 junction**:code-server 树被 pnpm 重装后旧链接会变成断链,
+ *  `existsSync` 对断链返回 false,直接再建会 EPERM)。 */
+function pathEntryExists(target) {
+  try {
+    lstatSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /** 把 VS Code 的「内部依赖目录」用 junction 补回老布局。
  *
  *  为什么需要:老模型里 `lib/vscode/node_modules` 与 `lib/vscode/extensions/node_modules` 是 npm 在树里
@@ -204,15 +227,24 @@ export function ensureInnerModuleLinks() {
     } catch { continue; }
     for (const name of Object.keys(deps)) {
       const link = join(dir, name);
-      if (existsSync(join(link, 'package.json'))) continue; // 已在位(真实目录或链接)
-      const target = resolveFromPlugin(name);
+      if (existsSync(join(link, 'package.json'))) continue; // 链接有效(真实目录或有效 junction)
+      if (pathEntryExists(link)) {
+        // 断链(树被重装过)→ 清掉重建
+        try {
+          rmSync(link, { recursive: true, force: true });
+        } catch (error) {
+          failed.push(`${name}: 旧链接清理失败 ${error && error.code ? error.code : error}`);
+          continue;
+        }
+      }
+      const target = packageRootFromPlugin(name);
       if (target === null) continue; // 该依赖没装(envCheck 会另行报告)
       try {
         mkdirSync(dirname(link), { recursive: true });
         symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir');
         created.push(name);
       } catch (error) {
-        failed.push(`${name}: ${error && error.message ? error.message : String(error)}`);
+        failed.push(`${name}: ${error && error.code ? error.code : error}`);
       }
     }
   }

package/lib/serve-dsh.mjs

@@ -0,0 +1,162 @@
+/**
+ * lib/serve-dsh.mjs — 把 VS Code server 挂到 DSH 自身 HTTP 端口上的两段式注册(serve=dsh)。
+ *
+ *   ctx.webServer.register({ kind: 'prefix', path: '/code-server', handler })     ← HTTP
+ *   ctx.webServer.registerUpgrade({ path: '/code-server/<productPath>', handler }) ← WebSocket(精确匹配)
+ *
+ * 两条路径都必须先过 ctx.connection.requestRejection():DSH 的 webServer 本身不做任何校验,
+ * 防护是逐路由的(Host/Origin fence + 浏览器 cookie 认证),缺了它 IDE 会成为源站上唯一的无认证面。
+ *
+ * 转发策略(Phase 0 实测):**剥掉挂载前缀**后转给 launcher 的命名管道 —— VS Code 侧保持根挂载,
+ * 与今天已验证的配置完全一致;客户端渲染出的资源引用全是相对路径,浏览器按 /code-server/ 解析,
+ * 因此同一套 prefix 路由就能覆盖 HTML、静态资源、vscode-remote-resource 与 /_static/*。
+ *
+ * 已知退化:转发端口(/proxy/:port)的 WebSocket 无法用精确升级路由覆盖(端口号在路径里),
+ * 需要 DSH 上游提供 prefix upgrade;HTTP 转发端口不受影响。
+ */
+
+import { request as httpRequest } from 'node:http';
+import { connect } from 'node:net';
+
+export const MOUNT_PATH = '/code-server';
+
+/** 前缀匹配(与 DSH webServer 的 prefix 语义一致:命中 p 与 p/<anything>)。 */
+function matchesPrefix(pathname, prefix) {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+/** 把 /code-server/xxx 转成上游要的 /xxx(空则 '/'),保留 query。 */
+function stripPrefix(url, prefix) {
+  const rest = url.slice(prefix.length);
+  return rest === '' ? '/' : rest;
+}
+
+function rejectionOf(connection, req) {
+  try {
+    return connection.requestRejection({ headers: req.headers }) ?? undefined;
+  } catch (error) {
+    return { error };
+  }
+}
+
+/** 转发目标的两种形态:命名管道(kind:'pipe')或回环 TCP(kind:'tcp')。
+ *  注意 http.request 用 socketPath、net.connect 用 path —— 两者键名不同,必须在这里翻译。 */
+function httpOptions(target, extra) {
+  return target.kind === 'pipe'
+    ? { socketPath: target.pipe, ...extra }
+    : { host: target.host, port: target.port, ...extra };
+}
+
+function connectTo(target, onConnect) {
+  return target.kind === 'pipe'
+    ? connect({ path: target.pipe }, onConnect)
+    : connect({ host: target.host, port: target.port }, onConnect);
+}
+
+/**
+ * 注册 IDE 的同源挂载点。
+ * @param {object} options
+ * @param {object} options.webServer - DSH webServer 服务(register / registerUpgrade)
+ * @param {object} options.connection - DSH connection 服务(requestRejection)
+ * @param {() => ({socketPath: string} | {host: string, port: number} | null)} options.getTarget
+ *   当前 launcher 的转发目标(命名管道为主;loopback TCP 用于测试/回退)
+ * @param {string} options.productPath - VS Code 客户端路径(quality-commit)
+ * @param {string} [options.mount] - 挂载前缀,默认 /code-server
+ * @param {(msg: string) => void} [options.log]
+ * @returns {{ disposers: (() => void)[], upgradePath: string }}
+ */
+export function mountOnWebServer({ webServer, connection, getTarget, productPath, mount = MOUNT_PATH, log = () => {} }) {
+  const upgradePath = `${mount}/${productPath}`;
+  const disposers = [];
+
+  /** 请求被 fence 拒绝时按 DSH 的约定回 401/403(upgrade 走裸 socket)。 */
+  function fence(req) {
+    const rejection = rejectionOf(connection, req);
+    if (rejection === undefined) return null;
+    if (typeof rejection === 'object' && rejection.error !== undefined) {
+      log(`requestRejection 抛错,按 403 处理: ${rejection.error?.message ?? rejection.error}`);
+      return 403;
+    }
+    return rejection;
+  }
+
+  disposers.push(webServer.register({
+    kind: 'prefix',
+    path: mount,
+    handler: (req, res) => {
+      try {
+        const pathname = new URL(req.url ?? '/', 'http://x').pathname;
+        if (!matchesPrefix(pathname, mount)) { res.writeHead(404); res.end(); return; }
+        const status = fence(req);
+        if (status !== null) {
+          res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+          res.end(status === 401 ? 'unauthorized\n' : 'forbidden\n');
+          return;
+        }
+        const target = getTarget();
+        if (target === null) {
+          res.writeHead(503, { 'content-type': 'text/plain; charset=utf-8' });
+          res.end('code-server 未启动\n');
+          return;
+        }
+        const upstream = httpRequest(httpOptions(target, {
+          method: req.method,
+          path: stripPrefix(req.url ?? '/', mount),
+          headers: req.headers,
+        }), (upstreamRes) => {
+          res.writeHead(upstreamRes.statusCode ?? 502, upstreamRes.headers);
+          upstreamRes.pipe(res);
+        });
+        upstream.on('error', (error) => {
+          log(`HTTP 转发失败(${req.method} ${req.url}): ${error.message}`);
+          if (!res.headersSent) res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+          if (!res.writableEnded) res.end('code-server 不可达\n');
+        });
+        req.on('aborted', () => upstream.destroy());
+        req.pipe(upstream);
+      } catch (error) {
+        // 路由回调里的异常绝不能冒泡到 DSH 的 webServer(会变成未捕获异常)
+        log(`HTTP 挂载点异常(${req.method} ${req.url}): ${error && error.stack ? error.stack : error}`);
+        if (!res.headersSent) res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
+        if (!res.writableEnded) res.end('code-server 挂载点异常\n');
+      }
+    },
+  }));
+
+  disposers.push(webServer.registerUpgrade({
+    path: upgradePath,
+    handler: (req, socket, head) => {
+      try {
+        const status = fence(req);
+        if (status !== null) {
+          socket.end(`HTTP/1.1 ${status} ${status === 401 ? 'Unauthorized' : 'Forbidden'}\r\nConnection: close\r\n\r\n`);
+          return;
+        }
+        const target = getTarget();
+        if (target === null) { socket.destroy(); return; }
+        const upstream = connectTo(target, () => {
+          const lines = [`GET ${stripPrefix(req.url ?? '/', mount)} HTTP/1.1`];
+          for (let i = 0; i < req.rawHeaders.length; i += 2) {
+            lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+          }
+          upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+          if (head !== undefined && head.length > 0) upstream.write(head);
+          upstream.pipe(socket);
+          socket.pipe(upstream);
+        });
+        upstream.on('error', (error) => { log(`WS 转发失败(${req.url}): ${error.message}`); socket.destroy(); });
+        socket.on('error', () => upstream.destroy());
+        socket.on('close', () => upstream.destroy());
+      } catch (error) {
+        log(`WS 挂载点异常(${req.url}): ${error && error.stack ? error.stack : error}`);
+        socket.destroy();
+      }
+    },
+  }));
+
+  log(`已挂载 ${mount}/ (HTTP prefix)+ ${upgradePath} (WS exact)`);
+  return {
+    upgradePath,
+    disposers,
+  };
+}