Store state on remote instead of browser

.github/workflows/build.yaml

@@ -194,7 +194,7 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: lib/vscode-reh-web-linux-x64
-          key: vscode-linux-x64-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }}
+          key: vscode-linux-x64-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'patches/series', 'ci/build/build-vscode.sh') }}
       - name: Build vscode
         if: steps.cache-vscode.outputs.cache-hit != 'true'
         run: |

patches/remote-secret-storage.diff

@@ -0,0 +1,86 @@
+AI: store secrets on remote for VS Code Web
+Index: code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/platform/secrets/common/secrets.ts
++++ code-server/lib/vscode/src/vs/platform/secrets/common/secrets.ts
+@@ -139,8 +139,13 @@ export class BaseSecretStorageService ex
+ 				return await readEncryptedSecret(
+ 					key,
+					(fullKey) => this.getValueFromStorage(key, fullKey, storageService),
+-					// If the storage service is in-memory, we don't need to decrypt
+-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.decrypt(v),
++					// Don't decrypt if storage is in-memory or if encryption service is not available
++					async (v) => {
++						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
++							return v;
++						}
++						return this._encryptionService.decrypt(v);
++					},
+ 					this._logService,
+ 				);
+ 			} catch (e) {
+@@ -160,8 +165,13 @@ export class BaseSecretStorageService ex
+ 					key,
+ 					value,
+					(fullKey, encrypted) => this.setValueInStorage(key, fullKey, encrypted, storageService),
+-					// If the storage service is in-memory, we don't need to encrypt
+-					this._type === 'in-memory' ? (v) => Promise.resolve(v) : (v) => this._encryptionService.encrypt(v),
++					// Don't encrypt if storage is in-memory or if encryption service is not available
++					async (v) => {
++						if (this._type === 'in-memory' || !await this._encryptionService.isEncryptionAvailable()) {
++							return v;
++						}
++						return this._encryptionService.encrypt(v);
++					},
+ 					this._logService,
+ 				);
+ 			} catch (e) {
+@@ -194,8 +204,9 @@ export class BaseSecretStorageService ex
+
+ 	private async initialize(): Promise<IStorageService> {
+ 		let storageService;
+-		if (!this._useInMemoryStorage && await this._encryptionService.isEncryptionAvailable()) {
+-			this._logService.trace(`[SecretStorageService] Encryption is available, using persisted storage`);
++		if (!this._useInMemoryStorage) {
++			// Use persisted storage when not forced to use in-memory
++			this._logService.trace(`[SecretStorageService] Using persisted storage`);
+ 			this._type = 'persisted';
+ 			storageService = this._storageService;
+ 		} else {
+@@ -203,7 +214,7 @@ export class BaseSecretStorageService ex
+ 			if (this._type === 'in-memory') {
+ 				return this._storageService;
+ 			}
+-			this._logService.trace('[SecretStorageService] Encryption is not available, falling back to in-memory storage');
++			this._logService.trace('[SecretStorageService] Falling back to in-memory storage');
+ 			this._type = 'in-memory';
+ 			storageService = this._register(new InMemoryStorageService());
+ 		}
+Index: code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
++++ code-server/lib/vscode/src/vs/workbench/services/secrets/browser/secretStorageService.ts
+@@ -22,9 +22,9 @@ export class BrowserSecretStorageService
+ 		@IBrowserWorkbenchEnvironmentService environmentService: IBrowserWorkbenchEnvironmentService,
+ 		@ILogService logService: ILogService
+ 	) {
+-		// We don't have encryption in the browser so instead we use the
+-		// in-memory base class implementation instead.
+-		super(true, storageService, encryptionService, logService);
++		// Use remote storage if enabled, otherwise use in-memory storage
++		const useRemoteStorage = environmentService.options?.remoteStorageEnabled ?? false;
++		super(!useRemoteStorage, storageService, encryptionService, logService);
+
+ 		if (environmentService.options?.secretStorageProvider) {
+ 			this._secretStorageProvider = environmentService.options.secretStorageProvider;
+Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
++++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
+@@ -625,2 +625,2 @@
+-		secretStorageProvider: config.remoteAuthority && !secretStorageKeyPath
+-			? undefined /* with a remote without embedder-preferred storage, store on the remote */
++		secretStorageProvider: config.remoteStorageEnabled || (config.remoteAuthority && !secretStorageKeyPath)
++			? undefined /* with remote storage enabled, or without embedder-prefered storage, store on the remote */
+ 	});
+ })();