nterminal 1.2.72 → 1.2.74

package/dist/server/code/codeServerManager.js

@@ -0,0 +1,764 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { createServer } from 'node:net';
+import { spawn } from 'node:child_process';
+import { constants as fsConstants } from 'node:fs';
+import { access, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const codeServerRepoLatestReleaseUrl = 'https://api.github.com/repos/coder/code-server/releases/latest';
+const codeServerDownloadBaseUrl = 'https://github.com/coder/code-server/releases/download';
+const codeServerIdleTimeoutSeconds = 60 * 60;
+const installLogLimit = 400;
+const startupLogLineLimit = 12;
+const healthCheckTimeoutMs = 30_000;
+const healthCheckIntervalMs = 500;
+const idleSweepIntervalMs = 60_000;
+const titleLockTtlMs = 24 * 60 * 60 * 1000;
+export class CodeServerError extends Error {
+    statusCode;
+    code;
+    constructor(statusCode, code, message = code) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.name = 'CodeServerError';
+    }
+}
+export class CodeServerManager {
+    config;
+    terminalManager;
+    addonRoot;
+    versionsDir;
+    tmpDir;
+    currentPath;
+    extensionsDir;
+    userDataRoot;
+    instances = new Map();
+    titleLocks = new Map();
+    idleSweepTimer;
+    job = null;
+    constructor(config, terminalManager) {
+        this.config = config;
+        this.terminalManager = terminalManager;
+        const stateDir = path.dirname(config.statePath);
+        this.addonRoot = path.join(stateDir, 'addons', 'code-server');
+        this.versionsDir = path.join(this.addonRoot, 'versions');
+        this.tmpDir = path.join(this.addonRoot, 'tmp');
+        this.currentPath = path.join(this.addonRoot, 'current');
+        this.extensionsDir = path.join(this.addonRoot, 'extensions');
+        this.userDataRoot = path.join(this.addonRoot, 'user-data');
+        this.idleSweepTimer = setInterval(() => this.stopIdleInstances(), idleSweepIntervalMs);
+        this.idleSweepTimer.unref?.();
+    }
+    async status(options = {}) {
+        const support = standaloneReleaseSupport();
+        const version = await this.installedVersion();
+        const latestVersion = options.checkLatest && support.supported ? await this.latestVersion().catch(() => null) : undefined;
+        return {
+            supported: support.supported,
+            ...(support.reason ? { unsupportedReason: support.reason } : {}),
+            installed: Boolean(version),
+            version,
+            installPath: this.currentPath,
+            ...(latestVersion !== undefined ? { latestVersion, updateAvailable: version && latestVersion ? version !== latestVersion : null } : {}),
+            job: this.job,
+            instances: this.instanceSummaries()
+        };
+    }
+    async startInstall(options = { action: 'install' }) {
+        if (this.job?.status === 'running') {
+            return { job: this.job, status: await this.status() };
+        }
+        const support = standaloneReleaseSupport();
+        if (!support.supported) {
+            throw new CodeServerError(409, 'code_server_unsupported_platform', support.reason);
+        }
+        const job = this.createJob(options.action);
+        void this.runInstall(job, options).catch((error) => {
+            this.failJob(job, error instanceof Error ? error.message : String(error));
+        });
+        return { job, status: await this.status() };
+    }
+    async openForTerminal(terminalId, options = {}) {
+        const terminal = this.terminalManager.getTerminal(terminalId);
+        if (!terminal) {
+            throw new CodeServerError(404, 'terminal_not_found');
+        }
+        const executable = await this.executablePath();
+        if (!executable) {
+            throw new CodeServerError(409, 'code_server_not_installed', 'Install the code-server add-on first.');
+        }
+        const liveCwd = await this.terminalManager.resolveTerminalCwd(terminalId);
+        if (!liveCwd) {
+            throw new CodeServerError(409, 'terminal_cwd_unavailable');
+        }
+        const cwd = await safeRealPath(liveCwd);
+        const displayTitle = codeServerDisplayTitle({
+            ...(options.serverName ? { serverName: options.serverName } : {}),
+            tabName: options.tabName ?? terminal.title,
+            cwd
+        });
+        const id = instanceIdForCwd(cwd);
+        const proxyBasePath = publicBasePathForInstance(id, options.publicBasePathTemplate);
+        const instance = await this.ensureInstance(id, cwd, executable, displayTitle, proxyBasePath);
+        const titleToken = this.createTitleLock(instance.id, displayTitle);
+        return {
+            url: instanceUrlForBasePath(instance.proxyBasePath, { titleToken }),
+            instance: this.instanceSummary(instance),
+            status: await this.status()
+        };
+    }
+    getInstance(id) {
+        const instance = this.instances.get(id);
+        if (!instance || !isChildRunning(instance.process)) {
+            if (instance) {
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+            }
+            return null;
+        }
+        instance.lastAccessedAt = new Date().toISOString();
+        return this.instanceSummary(instance);
+    }
+    getTitleForInstance(instanceId, titleToken) {
+        this.pruneExpiredTitleLocks();
+        const instance = this.instances.get(instanceId);
+        if (!instance || !isChildRunning(instance.process)) {
+            if (instance) {
+                this.instances.delete(instanceId);
+                this.deleteTitleLocksForInstance(instanceId);
+            }
+            return null;
+        }
+        const token = titleToken?.trim();
+        if (token) {
+            const lock = this.titleLocks.get(token);
+            if (lock && lock.instanceId === instanceId && lock.expiresAt > Date.now()) {
+                return lock.title;
+            }
+        }
+        instance.lastAccessedAt = new Date().toISOString();
+        return instance.displayTitle;
+    }
+    touchInstance(id) {
+        const instance = this.instances.get(id);
+        if (instance && isChildRunning(instance.process)) {
+            instance.lastAccessedAt = new Date().toISOString();
+        }
+    }
+    async stop(instanceId) {
+        if (instanceId) {
+            const instance = this.instances.get(instanceId);
+            if (instance) {
+                stopProcess(instance.process);
+                this.instances.delete(instanceId);
+                this.deleteTitleLocksForInstance(instanceId);
+            }
+            return this.status();
+        }
+        for (const instance of this.instances.values()) {
+            stopProcess(instance.process);
+        }
+        this.instances.clear();
+        this.titleLocks.clear();
+        return this.status();
+    }
+    async startUninstall() {
+        if (this.job?.status === 'running') {
+            return { job: this.job, status: await this.status() };
+        }
+        const job = this.createJob('uninstall');
+        void this.runUninstall(job).catch((error) => {
+            this.failJob(job, error instanceof Error ? error.message : String(error));
+        });
+        return { job, status: await this.status() };
+    }
+    dispose() {
+        clearInterval(this.idleSweepTimer);
+        for (const instance of this.instances.values()) {
+            stopProcess(instance.process);
+        }
+        this.instances.clear();
+        this.titleLocks.clear();
+    }
+    async ensureInstance(id, cwd, executable, displayTitle, proxyBasePath) {
+        const current = this.instances.get(id);
+        if (current && isChildRunning(current.process)) {
+            if (current.proxyBasePath !== proxyBasePath) {
+                stopProcess(current.process);
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+            }
+            else {
+                current.displayTitle = displayTitle;
+                current.lastAccessedAt = new Date().toISOString();
+                return current;
+            }
+        }
+        if (current) {
+            this.instances.delete(id);
+        }
+        await mkdir(this.extensionsDir, { recursive: true, mode: 0o700 });
+        const userDataDir = path.join(this.userDataRoot, id);
+        await mkdir(userDataDir, { recursive: true, mode: 0o700 });
+        const port = await allocateLocalPort();
+        const now = new Date().toISOString();
+        const child = spawn(executable, [
+            '--bind-addr',
+            `127.0.0.1:${port}`,
+            '--auth',
+            'none',
+            '--disable-telemetry',
+            '--disable-update-check',
+            '--abs-proxy-base-path',
+            proxyBasePath,
+            '--user-data-dir',
+            userDataDir,
+            '--extensions-dir',
+            this.extensionsDir,
+            cwd
+        ], {
+            cwd,
+            env: buildCodeServerProcessEnv(),
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        const instance = { id, cwd, port, proxyBasePath, process: child, createdAt: now, lastAccessedAt: now, displayTitle };
+        this.instances.set(id, instance);
+        const startupErrors = [];
+        const startupOutput = [];
+        const onSpawnError = (error) => {
+            startupErrors.push(error);
+        };
+        child.once('error', onSpawnError);
+        child.on('exit', () => {
+            if (this.instances.get(id)?.process === child) {
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+            }
+        });
+        child.stdout?.on('data', () => undefined);
+        child.stderr?.on('data', (chunk) => collectRecentLines(startupOutput, chunk.toString()));
+        try {
+            await waitForHealthy(port, child, {
+                getStartupError: () => startupErrors[0] ?? null,
+                getFailureDetail: () => startupOutput.join('\n')
+            });
+            return instance;
+        }
+        catch (error) {
+            if (this.instances.get(id)?.process === child) {
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+            }
+            stopProcess(child);
+            throw error;
+        }
+    }
+    async runInstall(job, options) {
+        await mkdir(this.addonRoot, { recursive: true, mode: 0o700 });
+        await mkdir(this.versionsDir, { recursive: true, mode: 0o700 });
+        await mkdir(this.tmpDir, { recursive: true, mode: 0o700 });
+        const support = standaloneReleaseSupport();
+        if (!support.supported || !support.assetPlatform) {
+            throw new Error(support.reason ?? 'unsupported platform');
+        }
+        this.appendJobLog(job, 'Resolving latest code-server release...');
+        const release = await this.latestReleaseAsset(support.assetPlatform);
+        const version = release.version;
+        const finalDir = path.join(this.versionsDir, version);
+        if (!options.force && await pathExists(path.join(finalDir, 'bin', 'code-server'))) {
+            this.appendJobLog(job, `code-server ${version} is already installed.`);
+            await this.pointCurrentAt(finalDir, version);
+            this.completeJob(job);
+            return;
+        }
+        if (this.instances.size > 0) {
+            this.appendJobLog(job, 'Stopping running VS Code sessions before updating...');
+            await this.stop();
+        }
+        const workDir = path.join(this.tmpDir, `${Date.now()}-${randomUUID()}`);
+        await mkdir(workDir, { recursive: true, mode: 0o700 });
+        const archivePath = path.join(workDir, 'code-server.tar.gz');
+        this.appendJobLog(job, `Downloading ${release.archiveName}...`);
+        try {
+            await runCommand('curl', ['-fL', '--retry', '2', '--connect-timeout', '15', '-o', archivePath, release.downloadUrl], {
+                cwd: workDir,
+                onOutput: (line) => this.appendJobLog(job, line)
+            });
+            this.appendJobLog(job, 'Verifying SHA-256 digest...');
+            await verifyFileSha256(archivePath, release.sha256);
+            this.appendJobLog(job, 'Validating archive paths...');
+            await validateTarArchive(archivePath);
+            this.appendJobLog(job, 'Extracting archive...');
+            await runCommand('tar', ['-xzf', archivePath, '-C', workDir], {
+                cwd: workDir,
+                onOutput: (line) => this.appendJobLog(job, line)
+            });
+            const extractedDir = path.join(workDir, `code-server-${version}-${support.assetPlatform}`);
+            if (!await pathExists(path.join(extractedDir, 'bin', 'code-server'))) {
+                throw new Error('downloaded archive did not contain bin/code-server');
+            }
+            await rm(finalDir, { recursive: true, force: true });
+            await rename(extractedDir, finalDir);
+            await this.pointCurrentAt(finalDir, version);
+            this.appendJobLog(job, `Installed code-server ${version}.`);
+            this.completeJob(job);
+        }
+        finally {
+            await rm(workDir, { recursive: true, force: true });
+        }
+    }
+    async runUninstall(job) {
+        this.appendJobLog(job, 'Stopping code-server instances...');
+        await this.stop();
+        this.appendJobLog(job, `Removing ${this.addonRoot}...`);
+        await rm(this.addonRoot, { recursive: true, force: true });
+        this.appendJobLog(job, 'Removed code-server add-on.');
+        this.completeJob(job);
+    }
+    async latestVersion() {
+        return (await this.latestRelease()).version;
+    }
+    async latestReleaseAsset(assetPlatform) {
+        const release = await this.latestRelease();
+        const archiveName = `code-server-${release.version}-${assetPlatform}.tar.gz`;
+        const asset = release.assets.find((candidate) => candidate.name === archiveName);
+        if (!asset) {
+            throw new Error(`GitHub release did not include ${archiveName}`);
+        }
+        const downloadUrl = typeof asset.browser_download_url === 'string'
+            ? asset.browser_download_url
+            : `${codeServerDownloadBaseUrl}/v${release.version}/${archiveName}`;
+        const sha256 = parseGitHubSha256Digest(asset.digest);
+        if (!sha256) {
+            throw new Error(`GitHub release asset ${archiveName} did not include a SHA-256 digest`);
+        }
+        return { version: release.version, archiveName, downloadUrl, sha256 };
+    }
+    async latestRelease() {
+        const response = await fetch(codeServerRepoLatestReleaseUrl, {
+            headers: {
+                accept: 'application/vnd.github+json',
+                'user-agent': 'nterminal-code-server-addon'
+            },
+            signal: AbortSignal.timeout(20_000)
+        });
+        if (!response.ok) {
+            throw new Error(`GitHub release lookup failed: HTTP ${response.status}`);
+        }
+        const json = await response.json();
+        const tag = typeof json.tag_name === 'string' ? json.tag_name : '';
+        if (!/^v\d+\.\d+\.\d+$/.test(tag)) {
+            throw new Error('GitHub release lookup returned an invalid tag');
+        }
+        const assets = Array.isArray(json.assets)
+            ? json.assets.filter((asset) => asset !== null && typeof asset === 'object')
+            : [];
+        return { version: tag.slice(1), assets };
+    }
+    async installedVersion() {
+        try {
+            const version = (await readFile(path.join(this.currentPath, '.nterminal-code-server-version'), 'utf8')).trim();
+            if (/^\d+\.\d+\.\d+$/.test(version)) {
+                return version;
+            }
+        }
+        catch {
+            // Fall back to probing the executable below.
+        }
+        const executable = await this.executablePath();
+        if (!executable) {
+            return null;
+        }
+        try {
+            const result = await runCommand(executable, ['--version'], { timeoutMs: 10_000 });
+            const firstLine = result.stdout.split(/\r?\n/).find(Boolean)?.trim() ?? '';
+            return /^\d+\.\d+\.\d+$/.test(firstLine) ? firstLine : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async executablePath() {
+        const executable = path.join(this.currentPath, 'bin', 'code-server');
+        try {
+            await access(executable, fsConstants.X_OK);
+            return executable;
+        }
+        catch {
+            return null;
+        }
+    }
+    async pointCurrentAt(finalDir, version) {
+        await writeFile(path.join(finalDir, '.nterminal-code-server-version'), `${version}\n`, { mode: 0o600 });
+        const nextLink = path.join(this.addonRoot, `current.${process.pid}.${Date.now()}.tmp`);
+        await rm(nextLink, { recursive: true, force: true });
+        await symlink(finalDir, nextLink);
+        await rm(this.currentPath, { recursive: true, force: true });
+        await rename(nextLink, this.currentPath);
+    }
+    createJob(action) {
+        const job = {
+            id: randomUUID(),
+            action,
+            status: 'running',
+            startedAt: new Date().toISOString(),
+            finishedAt: null,
+            logs: []
+        };
+        this.job = job;
+        return job;
+    }
+    appendJobLog(job, line) {
+        const text = line.trim();
+        if (!text) {
+            return;
+        }
+        job.logs.push(text);
+        if (job.logs.length > installLogLimit) {
+            job.logs.splice(0, job.logs.length - installLogLimit);
+        }
+    }
+    completeJob(job) {
+        job.status = 'succeeded';
+        job.finishedAt = new Date().toISOString();
+    }
+    failJob(job, message) {
+        job.status = 'failed';
+        job.finishedAt = new Date().toISOString();
+        job.error = message;
+        this.appendJobLog(job, message);
+    }
+    instanceSummaries() {
+        const summaries = [];
+        for (const [id, instance] of this.instances) {
+            if (!isChildRunning(instance.process)) {
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+                continue;
+            }
+            summaries.push(this.instanceSummary(instance));
+        }
+        return summaries;
+    }
+    instanceSummary(instance) {
+        return {
+            id: instance.id,
+            cwd: instance.cwd,
+            url: instanceUrlForBasePath(instance.proxyBasePath),
+            port: instance.port,
+            createdAt: instance.createdAt,
+            lastAccessedAt: instance.lastAccessedAt,
+            displayTitle: instance.displayTitle
+        };
+    }
+    stopIdleInstances() {
+        const now = Date.now();
+        for (const [id, instance] of this.instances) {
+            if (!isChildRunning(instance.process)) {
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+                continue;
+            }
+            const lastAccessedAt = Date.parse(instance.lastAccessedAt);
+            if (Number.isFinite(lastAccessedAt) && now - lastAccessedAt > codeServerIdleTimeoutSeconds * 1000) {
+                stopProcess(instance.process);
+                this.instances.delete(id);
+                this.deleteTitleLocksForInstance(id);
+            }
+        }
+    }
+    createTitleLock(instanceId, title) {
+        this.pruneExpiredTitleLocks();
+        const token = randomUUID();
+        this.titleLocks.set(token, {
+            instanceId,
+            title,
+            expiresAt: Date.now() + titleLockTtlMs
+        });
+        return token;
+    }
+    pruneExpiredTitleLocks() {
+        const now = Date.now();
+        for (const [token, lock] of this.titleLocks) {
+            if (lock.expiresAt <= now || !this.instances.has(lock.instanceId)) {
+                this.titleLocks.delete(token);
+            }
+        }
+    }
+    deleteTitleLocksForInstance(instanceId) {
+        for (const [token, lock] of this.titleLocks) {
+            if (lock.instanceId === instanceId) {
+                this.titleLocks.delete(token);
+            }
+        }
+    }
+}
+export function instanceUrl(instanceId, options = {}) {
+    return instanceUrlForBasePath(instanceUrlPrefix(instanceId), options);
+}
+export function instanceUrlPrefix(instanceId) {
+    return `/code/instances/${encodeURIComponent(instanceId)}`;
+}
+export function instanceUrlForBasePath(basePath, options = {}) {
+    const normalized = basePath.endsWith('/') ? basePath : `${basePath}/`;
+    return options.titleToken ? `${normalized}?nterminalTitle=${encodeURIComponent(options.titleToken)}` : normalized;
+}
+function publicBasePathForInstance(instanceId, template) {
+    const raw = template?.trim();
+    if (!raw) {
+        return instanceUrlPrefix(instanceId);
+    }
+    if (!raw.includes('{instanceId}')) {
+        throw new CodeServerError(400, 'invalid_code_server_public_base_path');
+    }
+    const basePath = raw.split('{instanceId}').join(encodeURIComponent(instanceId));
+    if (basePath.length > 512 ||
+        !basePath.startsWith('/') ||
+        basePath.startsWith('//') ||
+        basePath.includes('?') ||
+        basePath.includes('#') ||
+        basePath.includes('\0')) {
+        throw new CodeServerError(400, 'invalid_code_server_public_base_path');
+    }
+    return basePath.endsWith('/') ? basePath.slice(0, -1) : basePath;
+}
+function standaloneReleaseSupport() {
+    if (process.platform !== 'linux') {
+        return { supported: false, reason: `Standalone install currently supports Linux only in NTerminal add-on mode (detected ${process.platform}).` };
+    }
+    if (process.arch === 'x64') {
+        return { supported: true, assetPlatform: 'linux-amd64' };
+    }
+    if (process.arch === 'arm64') {
+        return { supported: true, assetPlatform: 'linux-arm64' };
+    }
+    return { supported: false, reason: `code-server standalone releases are not available for ${process.platform}/${process.arch}.` };
+}
+export function buildCodeServerProcessEnv(baseEnv = process.env) {
+    const env = {};
+    const allowedKeys = [
+        'HOME',
+        'LANG',
+        'LC_ALL',
+        'LC_CTYPE',
+        'LOGNAME',
+        'PATH',
+        'SHELL',
+        'TMPDIR',
+        'USER',
+        'XDG_CACHE_HOME',
+        'XDG_CONFIG_HOME',
+        'XDG_DATA_HOME',
+        'XDG_RUNTIME_DIR'
+    ];
+    for (const key of allowedKeys) {
+        const value = baseEnv[key];
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    env.TERM = 'xterm-256color';
+    env.COLORTERM = baseEnv.COLORTERM ?? 'truecolor';
+    env.CODE_SERVER_IDLE_TIMEOUT_SECONDS = String(codeServerIdleTimeoutSeconds);
+    env.VSCODE_PROXY_URI = './proxy/{{port}}';
+    ensureUtf8Locale(env);
+    return env;
+}
+function instanceIdForCwd(cwd) {
+    return createHash('sha256').update(cwd).digest('hex').slice(0, 24);
+}
+function codeServerDisplayTitle(options) {
+    const serverName = normalizeTitlePart(options.serverName) || 'Local';
+    const tabName = normalizeTitlePart(options.tabName) || path.basename(options.cwd) || 'Terminal';
+    return `[${serverName} - ${tabName}]`;
+}
+function normalizeTitlePart(value) {
+    return value?.replace(/\s+/g, ' ').trim().slice(0, 80) ?? '';
+}
+async function allocateLocalPort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            server.close(() => {
+                if (address && typeof address === 'object') {
+                    resolve(address.port);
+                }
+                else {
+                    reject(new Error('failed to allocate local port'));
+                }
+            });
+        });
+    });
+}
+async function waitForHealthy(port, child, options = {}) {
+    const deadline = Date.now() + healthCheckTimeoutMs;
+    while (Date.now() < deadline) {
+        const startupError = options.getStartupError?.();
+        if (startupError) {
+            throw new Error(withFailureDetail(`code-server failed to start: ${startupError.message}`, options.getFailureDetail?.()));
+        }
+        if (!isChildRunning(child)) {
+            throw new Error(withFailureDetail(`code-server exited before becoming healthy (exit ${child.exitCode ?? child.signalCode ?? 'unknown'})`, options.getFailureDetail?.()));
+        }
+        try {
+            const response = await fetch(`http://127.0.0.1:${port}/healthz`, { signal: AbortSignal.timeout(1500) });
+            if (response.ok) {
+                return;
+            }
+        }
+        catch {
+            // Keep polling until the process exits or the deadline passes.
+        }
+        await sleep(healthCheckIntervalMs);
+    }
+    stopProcess(child);
+    throw new Error(withFailureDetail('code-server did not become healthy in time', options.getFailureDetail?.()));
+}
+function isChildRunning(child) {
+    return child.exitCode === null && child.signalCode === null && !child.killed;
+}
+function stopProcess(child) {
+    if (!isChildRunning(child)) {
+        return;
+    }
+    child.kill('SIGTERM');
+    setTimeout(() => {
+        if (isChildRunning(child)) {
+            child.kill('SIGKILL');
+        }
+    }, 5000).unref?.();
+}
+async function safeRealPath(value) {
+    try {
+        return await realpath(value);
+    }
+    catch {
+        return path.resolve(value);
+    }
+}
+function collectRecentLines(target, text) {
+    for (const line of text.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed) {
+            target.push(trimmed);
+        }
+    }
+    if (target.length > startupLogLineLimit) {
+        target.splice(0, target.length - startupLogLineLimit);
+    }
+}
+function withFailureDetail(message, detail) {
+    const trimmed = detail?.trim();
+    return trimmed ? `${message}\n${trimmed}` : message;
+}
+function parseGitHubSha256Digest(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const match = /^sha256:([a-f0-9]{64})$/i.exec(value.trim());
+    return match?.[1]?.toLowerCase() ?? null;
+}
+async function verifyFileSha256(filePath, expectedSha256) {
+    const actual = await fileSha256(filePath);
+    if (actual !== expectedSha256.toLowerCase()) {
+        throw new Error(`code-server archive checksum mismatch: expected ${expectedSha256}, got ${actual}`);
+    }
+}
+async function fileSha256(filePath) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(filePath)) {
+        hash.update(chunk);
+    }
+    return hash.digest('hex');
+}
+function ensureUtf8Locale(env) {
+    const characterLocale = env.LC_ALL ?? env.LC_CTYPE ?? env.LANG;
+    if (isUtf8Locale(characterLocale)) {
+        if (!env.LANG) {
+            env.LANG = characterLocale;
+        }
+        if (!env.LC_ALL && !env.LC_CTYPE) {
+            env.LC_CTYPE = characterLocale;
+        }
+        return;
+    }
+    env.LANG = 'en_US.UTF-8';
+    if (!env.LC_ALL) {
+        env.LC_CTYPE = 'en_US.UTF-8';
+    }
+}
+function isUtf8Locale(value) {
+    return Boolean(value && /\.?UTF-?8/i.test(value));
+}
+async function pathExists(value) {
+    try {
+        await lstat(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function validateTarArchive(archivePath) {
+    const result = await runCommand('tar', ['-tzf', archivePath], { timeoutMs: 30_000 });
+    const entries = result.stdout.split(/\r?\n/).filter(Boolean);
+    if (entries.length === 0) {
+        throw new Error('archive is empty');
+    }
+    for (const entry of entries) {
+        if (entry.startsWith('/') || entry.includes('\\') || entry.split('/').some((part) => part === '..')) {
+            throw new Error(`archive contains unsafe path: ${entry}`);
+        }
+    }
+}
+function runCommand(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            cwd: options.cwd ?? os.homedir(),
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        const chunks = [];
+        const errChunks = [];
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+            reject(new Error(`${command} timed out`));
+        }, options.timeoutMs ?? 120_000);
+        timer.unref?.();
+        child.stdout.on('data', (chunk) => {
+            const text = chunk.toString();
+            chunks.push(text);
+            for (const line of text.split(/\r?\n/)) {
+                options.onOutput?.(line);
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            const text = chunk.toString();
+            errChunks.push(text);
+            for (const line of text.split(/\r?\n/)) {
+                options.onOutput?.(line);
+            }
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on('exit', (code) => {
+            clearTimeout(timer);
+            const stdout = chunks.join('');
+            const stderr = errChunks.join('');
+            if (code === 0) {
+                resolve({ stdout, stderr });
+                return;
+            }
+            reject(new Error((stderr || stdout || `${command} exited ${code}`).trim()));
+        });
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=codeServerManager.js.map