code-server¶
Status: Current | Last reviewed: 2026-08-28
A packaged in-browser VS Code instance, scoped per workspace (A2UI catalog or capability). Lets non-developers author A2UI components and capabilities without setting up a local toolchain.
Source¶
Runtime¶
| Aspect | Value |
|---|---|
| Base | code-server (open-source VS Code build) |
| Sidecar | nginx auth-proxy |
| Port (Vanguard) | 127.0.0.1:8444 |
| JWT secret | Shared with collab-gateway |
What it does¶
Two workspace types share the editor, the /workspaces volume, and the JWT
auth flow, distinguished by folder prefix and marker file:
| Type | Folder prefix | Marker | Editor link minted by | Publish path |
|---|---|---|---|---|
| A2UI catalog | catalog- |
catalog.json |
/api/catalogs/:id/editor-link |
preview panel → studio-api → catalog-builder |
| Capability | capability- |
capability.json |
/api/capabilities/:id/editor-link |
TrueServe: Publish Capability command → studio-api → ai-manager /publish-from-workspace |
- Mounts the active workspace source directory.
- Provides terminals scoped to the workspace (catalogs: build/publish/restore; capabilities are data-only — ai-manager scaffolds and publishes them directly, no catalog-builder involvement).
- Runs the in-editor TrueServe extension which:
- Polls collab-gateway for presence on the workspace.
- Annotates the file tree, gutter, and status bar with teammate avatars.
- Surfaces an upgraded Team panel.
- Contributes
TrueServe: Validate Capability/Publish Capabilitycommands (right-clickcapability.json; they open the Capability panel — a webview, because studio-api auth rides the per-connection cs_auth cookie that only webview fetches carry), plus rich section editors for a capability workspace's tools.json / variables.json / logic.json / config-schema.json / constraints.json (form UIs over the same text documents; workspace.vscode/settings.jsoneditorAssociations make them the default there, and "Open With… → Text Editor" is the raw-JSON escape hatch). - Ships Claude Code (CLI + sidebar extension, Bedrock pre-auth) with
authoring skills auto-symlinked from
apps/code-server/skills/(catalog-component,capability-authoring).
The extension source is at apps/code-server/extension/.
See capability packs for the
capability workspace contract.
Dependencies¶
| Service | Purpose |
|---|---|
| collab-gateway | Presence (HTTP polling, 5s) |
| ai-manager | Catalog metadata + auth |
| catalog-builder | /publish + /restore commands |
Vanguard¶
Compose file: docker-compose.code-server.yml. Start by including the file in the wake-up flow. Reaches host services via host.docker.internal.
/workspaces is shared with the host through TSF_CATALOG_WORKSPACES.
Production¶
Helm chart at charts/code-server. One pod per active editing user; ephemeral. Identity is injected via env vars TRUESERVE_USER_ID, TRUESERVE_TENANT_ID, TRUESERVE_USER_NAME and presented to collab-gateway as service-to-service headers.
The nginx auth-proxy validates browser ?tkn= / cs_auth JWTs through
ai-manager's /api/auth/code-server-verify route. For shared or production
deployments, set CODE_SERVER_VERIFY_TOKEN on ai-manager and configure
authProxy.verifyTokenSecret in the code-server chart so direct callers cannot
spoof the auth-proxy-only X-Original-* headers.