clean up diffr machinery in remote stack

.github/workflows/review-desktop-preview.yml

@@ -105,10 +105,12 @@ jobs:
     name: Publish npm package
     needs: version
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     permissions:
       contents: read
       id-token: write
+    outputs:
+      whiteboard_remote: ${{ steps.remote.outputs.whiteboard_remote }}
     env:
       VERSION: ${{ needs.version.outputs.version }}
       COMMIT: ${{ needs.version.outputs.commit }}
@@ -140,12 +142,64 @@ jobs:
           fi
           echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
           echo "published=$PUBLISHED" >> "$GITHUB_OUTPUT"
+      - name: Install Code OSS native build prerequisites
+        run: |
+          # The hosted runner image lists an HTTP Azure mirror first. That
+          # mirror can accept the release file and then hang on package indexes.
+          echo 'https://archive.ubuntu.com/ubuntu/' | sudo tee /etc/apt/apt-mirrors.txt >/dev/null
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libx11-dev libxkbfile-dev libkrb5-dev libsecret-1-dev
+      - name: Setup Code OSS Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: apps/review-desktop/code-oss/.nvmrc
+          cache: npm
+          cache-dependency-path: apps/review-desktop/code-oss/**/package-lock.json
+      - name: Compute Code OSS dependency key
+        id: code-oss-inputs
+        run: |
+          DIGEST=$(node apps/review-desktop/scripts/code-oss-bootstrap.mjs digest apps/review-desktop/code-oss)
+          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
+      - name: Restore Code OSS dependencies
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            apps/review-desktop/code-oss/node_modules
+            apps/review-desktop/code-oss/build/node_modules
+            apps/review-desktop/code-oss/extensions/node_modules
+            apps/review-desktop/code-oss/extensions/*/node_modules
+            apps/review-desktop/code-oss/extensions/*/server/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/remote/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/remote/web/node_modules
+            ~/.cache/node-gyp
+          key: ${{ runner.os }}-code-oss-deps-v3-${{ steps.code-oss-inputs.outputs.digest }}
+          restore-keys: |
+            ${{ runner.os }}-code-oss-deps-v3-
+      - name: Build the VS Code server
+        run: |
+          source apps/review-desktop/scripts/code-oss-dependencies.sh
+          ensure_code_oss_dependencies "$PWD/apps/review-desktop" "$PWD/apps/review-desktop/code-oss"
+          BUILD_SOURCEVERSION="$COMMIT" node apps/review-desktop/scripts/build-remote-runtime.mjs
       - name: Build release tarball
         run: |
           jq -n --arg version "$VERSION" --arg commit "$COMMIT" '{$version, $commit}' > release-plan.json
           node scripts/pack-review-cli.mjs release-artifacts
       - name: Test installed tarball without Desktop
         run: node scripts/smoke-review-cli.mjs "release-artifacts/dev.fast-whiteboard-${VERSION}.tgz" "$VERSION"
+      - name: Pin the remote package and Node
+        id: remote
+        env:
+          PUBLISHED: ${{ steps.npm.outputs.published }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          TARBALL="release-artifacts/dev.fast-whiteboard-${VERSION}.tgz"
+          if [ "$PUBLISHED" = true ] && [ "$DRY_RUN" != true ]; then
+            TARBALL="$RUNNER_TEMP/$(cd "$RUNNER_TEMP" && npm pack "@dev.fast/whiteboard@${VERSION}" --silent)"
+          fi
+          PIN=$(node apps/review-desktop/scripts/stamp-remote-package.mjs "$TARBALL")
+          echo "whiteboard_remote=$PIN" >> "$GITHUB_OUTPUT"
       - name: Validate npm publish command
         if: ${{ steps.npm.outputs.published != 'true' }}
         env:
@@ -175,6 +229,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       release_signing: ${{ !inputs.dry_run }}
     secrets: inherit
 
@@ -188,6 +243,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       sign: true
 
   macos:
@@ -200,6 +256,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       channel: preview
     secrets: inherit
 

.github/workflows/review-desktop-release.yml

@@ -278,10 +278,12 @@ jobs:
     name: Publish npm package
     needs: version
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     permissions:
       contents: read
       id-token: write
+    outputs:
+      whiteboard_remote: ${{ steps.remote.outputs.whiteboard_remote }}
     env:
       VERSION: ${{ needs.version.outputs.version }}
       COMMIT: ${{ needs.version.outputs.commit }}
@@ -313,12 +315,64 @@ jobs:
           fi
           echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
           echo "published=$PUBLISHED" >> "$GITHUB_OUTPUT"
+      - name: Install Code OSS native build prerequisites
+        run: |
+          # The hosted runner image lists an HTTP Azure mirror first. That
+          # mirror can accept the release file and then hang on package indexes.
+          echo 'https://archive.ubuntu.com/ubuntu/' | sudo tee /etc/apt/apt-mirrors.txt >/dev/null
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libx11-dev libxkbfile-dev libkrb5-dev libsecret-1-dev
+      - name: Setup Code OSS Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: apps/review-desktop/code-oss/.nvmrc
+          cache: npm
+          cache-dependency-path: apps/review-desktop/code-oss/**/package-lock.json
+      - name: Compute Code OSS dependency key
+        id: code-oss-inputs
+        run: |
+          DIGEST=$(node apps/review-desktop/scripts/code-oss-bootstrap.mjs digest apps/review-desktop/code-oss)
+          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
+      - name: Restore Code OSS dependencies
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: |
+            apps/review-desktop/code-oss/node_modules
+            apps/review-desktop/code-oss/build/node_modules
+            apps/review-desktop/code-oss/extensions/node_modules
+            apps/review-desktop/code-oss/extensions/*/node_modules
+            apps/review-desktop/code-oss/extensions/*/server/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/remote/node_modules
+            apps/review-desktop/code-oss/.build/distro/npm/remote/web/node_modules
+            ~/.cache/node-gyp
+          key: ${{ runner.os }}-code-oss-deps-v3-${{ steps.code-oss-inputs.outputs.digest }}
+          restore-keys: |
+            ${{ runner.os }}-code-oss-deps-v3-
+      - name: Build the VS Code server
+        run: |
+          source apps/review-desktop/scripts/code-oss-dependencies.sh
+          ensure_code_oss_dependencies "$PWD/apps/review-desktop" "$PWD/apps/review-desktop/code-oss"
+          BUILD_SOURCEVERSION="$COMMIT" node apps/review-desktop/scripts/build-remote-runtime.mjs
       - name: Build release tarball
         run: |
           jq -n --arg version "$VERSION" --arg commit "$COMMIT" '{$version, $commit}' > release-plan.json
           node scripts/pack-review-cli.mjs release-artifacts
       - name: Test installed tarball without Desktop
         run: node scripts/smoke-review-cli.mjs "release-artifacts/dev.fast-whiteboard-${VERSION}.tgz" "$VERSION"
+      - name: Pin the remote package and Node
+        id: remote
+        env:
+          PUBLISHED: ${{ steps.npm.outputs.published }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          TARBALL="release-artifacts/dev.fast-whiteboard-${VERSION}.tgz"
+          if [ "$PUBLISHED" = true ] && [ "$DRY_RUN" != true ]; then
+            TARBALL="$RUNNER_TEMP/$(cd "$RUNNER_TEMP" && npm pack "@dev.fast/whiteboard@${VERSION}" --silent)"
+          fi
+          PIN=$(node apps/review-desktop/scripts/stamp-remote-package.mjs "$TARBALL")
+          echo "whiteboard_remote=$PIN" >> "$GITHUB_OUTPUT"
       - name: Validate npm publish command
         if: ${{ steps.npm.outputs.published != 'true' }}
         env:
@@ -346,6 +400,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       release_signing: ${{ !inputs.dry_run }}
     secrets: inherit
 
@@ -360,6 +415,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       sign: true
 
   macos:
@@ -372,6 +428,7 @@ jobs:
     with:
       commit: ${{ needs.version.outputs.commit }}
       version: ${{ needs.version.outputs.version }}
+      whiteboard_remote: ${{ needs.npm.outputs.whiteboard_remote }}
       channel: stable
     secrets: inherit
 

.github/workflows/review-linux-build.yml

@@ -9,6 +9,10 @@ on:
       version:
         type: string
         default: ""
+      whiteboard_remote:
+        description: The npm job's remote pin (stamp-remote-package.mjs); required with a version.
+        type: string
+        default: ""
       package_revision:
         type: string
         default: "1"
@@ -48,6 +52,11 @@ jobs:
           QUALITY=stable
           if [[ "$VERSION" == *-preview.* ]]; then QUALITY=preview; fi
           node apps/review-desktop/scripts/stamp-release-channel.mjs --version "$VERSION" --quality "$QUALITY"
+      - name: Pin the remote package and Node
+        if: inputs.version != ''
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-package.mjs --pinned "$WHITEBOARD_REMOTE"
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:

.github/workflows/review-macos-build.yml

@@ -12,6 +12,10 @@ on:
       channel:
         required: true
         type: string
+      whiteboard_remote:
+        description: The npm job's remote pin (stamp-remote-package.mjs).
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -155,6 +159,11 @@ jobs:
             --version "$RELEASE_VERSION" \
             --quality "${{ inputs.channel }}"
 
+      - name: Pin the remote package and Node
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-package.mjs --pinned "$WHITEBOARD_REMOTE"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 

.github/workflows/review-windows-build.yml

@@ -9,6 +9,10 @@ on:
       version:
         type: string
         required: true
+      whiteboard_remote:
+        description: The npm job's remote pin (stamp-remote-package.mjs); required with a version.
+        type: string
+        default: ""
       artifact_name:
         type: string
         default: windows-packages
@@ -65,6 +69,10 @@ jobs:
           QUALITY=stable
           if [[ "$VERSION" == *-preview.* ]]; then QUALITY=preview; fi
           node apps/review-desktop/scripts/stamp-release-channel.mjs --version "$VERSION" --quality "$QUALITY"
+      - name: Pin the remote package and Node
+        env:
+          WHITEBOARD_REMOTE: ${{ inputs.whiteboard_remote }}
+        run: node apps/review-desktop/scripts/stamp-remote-package.mjs --pinned "$WHITEBOARD_REMOTE"
       - name: Restore native dependencies
         id: native-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6

CONTRIBUTING.md

@@ -66,15 +66,6 @@ Run the full check suite before you open a pull request:
 pnpm run ci
 ```
 
-DOM-facing tests run in Chromium through Vitest Browser Mode. Install the
-browser once, then run the headless suite or watch mode:
-
-```sh
-pnpm --filter @dev.fast/whiteboard exec playwright install chromium
-pnpm --filter @dev.fast/whiteboard test:browser
-pnpm --filter @dev.fast/whiteboard test:browser:watch
-```
-
 Pure Node, filesystem, and server tests run through
 `pnpm --filter @dev.fast/whiteboard test:node`.
 

apps/review-desktop/UPSTREAM

@@ -355,6 +355,26 @@ one of these entries:
 - `src/vs/platform/terminal/common/terminalEnvironment.ts`: quote complete path
   arguments with each shell's native rules instead of stripping metacharacters
   and emitting invalid POSIX quoting for apostrophes.
+- `src/vs/platform/remote/common/remoteAgentConnection.ts`: a permanent
+  failure ends only its own connection. Upstream's permanent failure is one
+  static flag that ends every connection in the window; with several remotes
+  per window a failed remote must end only its own connection. A failed
+  connection also sets upstream's never-written per-instance flag so it does
+  not reconnect again. A Management connection's reconnection failure is not
+  fatal either: it ends that connection only. Isolation is unconditional, so a
+  remote Source window gets no upstream reload dialog; it reconnects through
+  the fork's resolver and shows its host state in the status bar.
+- `src/vs/workbench/electron-browser/desktop.main.ts`: `createWorkspaceService`
+  is protected, not private, so the navigator entry's `DesktopMain` subclass
+  wraps a Source window's configuration service
+  (`review/services/configuration/reviewSourceWindowConfiguration.ts`): no
+  extension default, workspace file, folder or host machine setting can lower
+  its read-only rule, and the fork sets its title.
+- `src/vs/platform/window/common/window.ts` and
+  `src/vs/platform/native/electron-main/nativeHostMainService.ts`: the
+  `openWindow` options `reviewReferencesToShow` and `reviewSourceTitle` run a
+  navigator command in the opened window (Find References, the title's review and side,
+  and a remote review's host alias for the window's host-state entry).
 - `extensions/package.json` and the extension `package.json`/`package-lock.json`
   files: `@vscode/extension-telemetry` is hoisted to the shared extensions
   install (github keeps its own ^1.0.0 copy; the shared copy is ^0.9.8). The
@@ -379,8 +399,10 @@ one of these entries:
   were regenerated rather than kept at the stock Code OSS GUIDs.
   Two identity gaps remain deliberately: `serverApplicationName`,
   `serverDataFolderName`, and `tunnelApplicationName` still hold their upstream
-  values because the fork ships no REH build and the agent-host stack uses those
-  names to locate a server on *remote* hosts; and `darwinProfileUUID` /
+  values because the agent-host stack uses those names to locate a server on
+  *remote* hosts. The fork does ship a trimmed remote server (below), but its
+  launcher (`whiteboard remote attach`) always passes `--server-data-dir`, so the
+  `serverDataFolderName` default is never used; and `darwinProfileUUID` /
   `darwinProfilePayloadUUID` are untouched upstream values kept only because
   `build/lib/policies/policyGenerator.ts` hard-throws without them, on a path
   nothing in this tree invokes.
@@ -478,7 +500,8 @@ one of these entries:
   `workbench-dev.html`: allow the local Review session connection and the
   native canvas Trusted Types policy in built and development launches.
 - `src/vs/base/common/product.ts`: declares the `reviewVersion` field described
-  above, so the About panel can read it typed.
+  above, so the About panel can read it typed, and `whiteboardRemote`, the
+  remote package and Node that release builds pin for remote installs.
 - `src/vs/code/electron-main/app.ts`: own the embedded Review server lifecycle
   and register the Review connection channel that hands the renderer the server
   endpoint the main process validated. Also swaps two update- and menu-related
@@ -581,6 +604,35 @@ one of these entries:
 - `licenses/`: fork-added third-party notices (eventsource-parser, zod,
   elkjs, libavoid-js, KaTeX, @vscode/codicons). `build/gulpfile.vscode.ts`
   copies this directory into packaged builds.
+- The remote server: a trimmed copy of upstream's server starts the stock
+  extension host on a remote machine, so remote reviews get language features
+  from the same extensions. `scripts/build-remote-runtime.mjs` bundles it.
+  Restored from the upstream commit above, unmodified: `src/server-main.ts`,
+  `src/bootstrap-server.ts`, and in `src/vs/server/node/`:
+  `extensionHostConnection.ts`, `extensionHostStatusService.ts`,
+  `extensionsScannerService.ts`, `remoteAgentEnvironmentImpl.ts`,
+  `remoteExtensionManagement.ts`, `remoteFileSystemProviderServer.ts`,
+  `remoteLanguagePacks.ts`, `serverConnectionToken.ts`,
+  `serverEnvironmentService.ts`, `serverLifetimeService.ts`.
+  Restored and trimmed, each trim marked with a `Whiteboard:` comment:
+  - `serverServices.ts`: keeps the logger, file, configuration, user data
+    profile, extension host status, lifetime and extensions scanner services,
+    and the `logger`, `userDataProfiles`, `remoteextensionsenvironment`,
+    `remoteExtensionsScanner`, `remoteFilesystem` and extension host debug
+    broadcast channels. `telemetry` is a no-op channel and `ITelemetryService`
+    is `NullTelemetryService`. Cuts requests, telemetry appenders and machine
+    ids, the gallery and extension installs, language packs, terminals, the
+    agent host, MCP and the sandbox helper. Installs the process error
+    listeners upstream's node `ErrorTelemetry` installs, so a cancelled request
+    after a clean disconnect does not end the server.
+  - `remoteExtensionsScanner.ts`: scans only; install-on-start, the gallery and
+    language pack installs are cut.
+  - `remoteExtensionHostAgentServer.ts`: the web client and
+    `/vscode-remote-resource` are cut, with a local `serveError`.
+  - `server.main.ts`: `spawnCli` reports that the extension management CLI is
+    not included.
+  The rest of `src/vs/server/` and `src/server-cli.ts` stay deleted.
+  `src/vs/server/node/reviewServerHandshake.test.ts` is fork-owned.
 
 ## Serialize the fork
 

apps/review-desktop/code-oss/build/buildfile.ts

@@ -26,7 +26,8 @@ export const workbenchDesktop = [
 	createModuleDescription('vs/workbench/api/node/extensionHostProcess'),
 	createModuleDescription('vs/review/review.desktop.main'),
 	createModuleDescription('vs/review/navigator.desktop.main'),
-	createModuleDescription('vs/review/electron-utility/reviewDesktopHostMain')
+	createModuleDescription('vs/review/electron-utility/reviewDesktopHostMain'),
+	createModuleDescription('vs/review/node/reviewSshAskpassMain')
 ];
 
 export const keyboardMaps = [

apps/review-desktop/code-oss/build/next/index.ts

@@ -96,6 +96,7 @@ const desktopEntryPoints = [
 	'vs/review/review.desktop.main',
 	'vs/review/navigator.desktop.main',
 	'vs/review/electron-utility/reviewDesktopHostMain',
+	'vs/review/node/reviewSshAskpassMain',
 	'vs/workbench/contrib/debug/node/telemetryApp',
 	'vs/platform/files/node/watcher/watcherMain',
 	'vs/platform/terminal/node/ptyHostMain',