Summary

Add a browser-based VS Code Web IDE for OneDev Workspaces: a workspace template that runs code-server, plus an authenticated reverse proxy under the OneDev origin so users can open/edit code in the browser without installing a local editor.

This continues the architecture discussion from OD-2765. Scope is browser Web IDE only (no local VS Code / remote-SSH attach).

Goals

1. Workspace Web IDE template — default image based on coder/code-server (MIT, Open VSX by default, FOSS-durable; architecture remains image-agnostic so openvscode-server can be an alternate template).
2. Authenticated reverse proxy — path under OneDev (e.g. {project}/~workspaces/{n}/ide/**) with HTTP + WebSocket support, gated by OneDev session auth / project workspace permissions.
3. UI entry points — “Open in Web IDE” from blob/branch/PR/workspaces surfaces; reconnect to an existing ACTIVE workspace when one already exists.

Non-goals

• Local VS Code attach via remote SSH / vscode:// tunnel into the workspace.
• Modeling this as a CI job / Job Executor feature (use Workspace lifecycle instead).

Architecture (agreed direction)

User (blob/branch/PR UI)
  → "Open in Web IDE"
  → WorkspaceService.create(spec=web-ide, branch/commit)
  → WorkspaceProvisioner (Docker / EE remote / K8s)
  → Container: code-server (exposed container port)
  → Browser: https://onedev/.../~workspaces/<n>/ide/**
       → authenticated reverse proxy (HTTP + WebSocket)

Why Workspaces (not Job Executors)

CI jobs are batch-oriented (timeouts, run-to-completion, teardown). Job services are sidecar DNS only — not browser-routed. Workspaces already provide long-lived containers, port mappings, git auth via workspace tokens, and UI entry points.

CORS

Path-based same-origin proxy under OneDev means a dedicated CORS layer is not required for the IDE itself. Prefer this over linking raw executor host ports (cross-origin).

Suggested implementation roadmap

1. MVP (config): Web IDE WorkspaceSpec template (code-server, containerPorts), document using existing port-mapping menu.
2. Authenticated reverse proxy (HTTP + WebSocket) under OneDev origin.
3. UI: “Open in Web IDE” + reconnect to existing ACTIVE workspace.
4. Hardening: idle timeout, concurrency limits, TLS/public URL behavior.
5. Scale-out: proxy routing with EE remote agent / K8s provisioners.

Key touch points (indicative)

• WorkspaceSpec / template + workspace settings UI
• ServerDockerProvisioner (and EE remote/K8s provisioners)
• DefaultWorkspaceService / WorkspaceRuntime
• New WS-capable reverse proxy + BaseUrlMapper mount
• Shiro/session gate on proxy; reuse workspace create/modify permissions
• Blob/branch/PR/workspaces UI entry points

Persistence

MVP: reuse existing Workspace entity (no schema change). Optional later: idle timeout / last-activity fields.

References

• Discussion / Q&A: OD-2765
• Docs: Working with Workspaces