ServerSync for Code Server

Sync AI coding sessions across devices with code-server: API keys, conversations, and extensions — all server-side.

Never re-enter your API keys, lose your conversation history, or reinstall extensions when switching between devices.

The Problem

When using code-server (VS Code in the browser), extensions like Cline, Roo Code, Zoo Code, and others store API keys using VS Code's SecretStorage API.

In code-server, SecretStorage is backed by the browser's IndexedDB, which is per-device. This means:

• 🔑 You configure your OpenRouter API key on your laptop → it works
• 🖥️ You connect from your desktop → the API key is gone, you must re-enter it
• 📱 You connect from your tablet → same thing, re-enter again

This extension solves that by synchronizing secrets through an encrypted file on the server.

How It Works

This extension provides two synchronization mechanisms:

1. API Keys & Secrets Sync (encrypted file)

flowchart LR
    A[Device 1<br/>Laptop] -->|Export| B[(Encrypted file<br/>on server)]
    B -->|Auto-import on startup| C[Device 2<br/>Desktop]
    B -->|Auto-import on startup| D[Device 3<br/>Tablet]
    C --> E[API keys available ✅]
    D --> F[API keys available ✅]

Loading

1. Export: Reads all known secrets from VS Code's SecretStorage, encrypts them with AES-256-GCM, and writes them to a file on the server.
2. Import: Reads the encrypted file, decrypts it, and writes the secrets back into the local browser's SecretStorage.
3. Auto-sync: On startup, if no local secrets are found, the extension automatically imports from the server file.

2. Conversation Sync (symlinks)

flowchart TB
    subgraph "Server filesystem"
        CS[.local/share/code-server/<br/>globalStorage/ — canonical]
        VSC[.vscode-server/<br/>globalStorage/ — symlinked]
    end
    CS -->|symlink| VSC
    Browser[code-server web<br/>Device 1] --> CS
    Remote[VS Code Remote-SSH<br/>Device 2] --> VSC
    Browser2[code-server web<br/>Device 3] --> CS

Loading

When you access the same server from different devices (via browser or Remote-SSH), VS Code uses two separate storage directories:

• .local/share/code-server/User/globalStorage/ — for code-server (web)
• .vscode-server/data/User/globalStorage/ — for VS Code Desktop (Remote-SSH)

The Link conversation storage command creates symlinks from .vscode-server to code-server so both environments read/write the same physical files. Conversations from Roo Code, Zoo Code, Cline, and other AI extensions are instantly shared.

⚠️ Note: This feature requires filesystem access and works on Linux/macOS servers. It creates symlinks at the OS level.

Security

• 🔒 AES-256-GCM encryption — secrets are encrypted before being written to disk
• 🔑 PBKDF2 key derivation — 100,000 iterations with a random salt
• 📁 Restrictive file permissions — sync file is chmod 600, passphrase file is chmod 600
• 🚫 No plaintext storage — the server file never contains unencrypted API keys
• 🧠 Passphrase stored in SecretStorage — the encryption passphrase is also stored in the browser's SecretStorage, with a file fallback for first connection on a new device

Installation

From VS Code Marketplace

1. Open the Extensions sidebar (Ctrl+Shift+X)
2. Search for "Code Server Secrets Sync"
3. Click Install

Manual installation (code-server)

# Download the .vsix file and install it
code-server --install-extension code-server-secrets-sync-0.1.0.vsix

Usage

First time setup (on a device that already has API keys configured)

1. Open the Command Palette (Ctrl+Shift+P)
2. Run: "Secrets Sync: Set encryption passphrase"
   • Enter a strong passphrase (min 8 characters)
   • Confirm the passphrase
3. Run: "Secrets Sync: Export secrets to server"
   • Your API keys are encrypted and saved to the server
   • You'll see a confirmation with the number of secrets exported

On a new device

1. Connect to code-server
2. The extension auto-imports secrets on startup (if auto-sync is enabled)
3. If prompted, reload the window to apply changes
4. If auto-sync didn't trigger, run manually:
   • "Secrets Sync: Set encryption passphrase" (use the same passphrase)
   • "Secrets Sync: Import secrets from server"

Commands

Command	Description
Secrets Sync: Set encryption passphrase	Set or change the encryption passphrase
Secrets Sync: Export secrets to server	Encrypt and save all secrets to the server file
Secrets Sync: Import secrets from server	Decrypt and load secrets from the server file
Secrets Sync: List synced secret keys	Show all secrets found in SecretStorage and sync file status
Secrets Sync: Enable auto-sync on startup	Enable automatic import on startup
Secrets Sync: Disable auto-sync on startup	Disable automatic import on startup
Secrets Sync: Link conversation storage (share across devices)	Create symlinks to share AI conversations between code-server and Remote-SSH
Secrets Sync: Show conversation sync status	Display which extension directories are linked and their symlink targets
Secrets Sync: Unlink a conversation extension	Remove a symlink for a specific extension

Configuration

Setting	Default	Description
secretsSync.autoSyncOnStartup	true	Automatically import secrets from the server on startup
secretsSync.autoLinkConversations	false	Automatically create conversation symlinks on startup
secretsSync.syncFilePath	""	Custom path for the encrypted sync file (empty = default location)
secretsSync.knownExtensions	["roo_cline_config_api_config", "cline_api_config"]	Additional SecretStorage keys to sync

Supported Extensions

The extension automatically discovers secrets for known AI coding extensions:

• ✅ Roo Code / Zoo Code (roo_cline_config_api_config)
• ✅ Cline (cline_api_config)
• ✅ Individual API keys: OpenRouter, OpenAI, Anthropic, Gemini, DeepSeek, Mistral, xAI, and many more

You can add custom keys via the secretsSync.knownExtensions setting.

Limitations

• VS Code SecretStorage API does not provide a way to enumerate all stored secrets. This extension checks a predefined list of known keys. If an extension uses a non-standard key, add it to secretsSync.knownExtensions.
• UI state (open tabs, panel state, message drafts) is stored in IndexedDB and cannot be synced by this extension.
• Concurrent access: if two devices export simultaneously, the last write wins. There is no locking mechanism.

Development

# Install dependencies
npm install

# Build
npm run build

# Watch mode
npm run watch

# Run tests
npm test

# Package for publishing
npm run package

License

MIT

Contributing

Contributions are welcome! Please open an issue or submit a pull request at GitHub.