Licensing clarification for commercial redistribution of code-server 4.141.0

[pontejunior]

Hello code-server maintainers,
We are developing OpenCloudBR, a cloud platform that will provide browser-based development environments using code-server.
Our initial offering will include development virtual machines with Python, Node.js, Git, and code-server. Customers may use these environments on our infrastructure or deploy the images in their own private clouds.
We intend to redistribute the original code-server 4.141.0 Debian package without modifications, preserving all applicable license notices.
During our licensing review, we identified that the package includes @vscode/copilot-api 0.5.2, which has licensing terms that differ from the MIT license of code-server.
We understand that GitHub Copilot subscriptions and services are separate from code-server. We do not intend to sell Copilot subscriptions or bundle access to paid Copilot services.
Before distributing our commercial development images, we would appreciate clarification on the following:

1. Does the original code-server 4.141.0 package have the necessary permissions for commercial redistribution, including its bundled Copilot-related components?
2. Do the licensing exceptions for @vscode/copilot-api cover downstream redistribution by independent cloud providers such as OpenCloudBR?
3. If additional permission is required, is there an official contact or recommended distribution approach that would allow us to provide code-server without licensing concerns?
   For reference:
   Package: code-server_4.141.0_amd64.deb
   SHA-256: f384beb4f3ba207e0bca27d0dbd36dd825d5aa909d78c6d4baa8703eaf6b77ba
   Release: https://github.com/coder/code-server/releases/tag/v4.141.0
   We appreciate your work on code-server and would like to ensure that our commercial offering complies with the applicable licenses.
   Thank you for your guidance.
   Best regards,
   OpenCloudBR Project Team
   Brazil

[dfbustosus]

I pulled the actual license text so your review can cite it precisely rather than paraphrase. Splitting your Q1 into its two components, because they have opposite answers:

code-server itself: yes. The code-server source and package are MIT (LICENSE, "Copyright (c) 2019 Coder Technologies Inc."). MIT permits commercial redistribution of the unmodified Debian package, provided you preserve copyright/license notices — which you already plan to do.

The bundled @vscode/copilot-api: no. That package is not MIT — its npm metadata says license: SEE LICENSE, and the bundled LICENSE file is GitHub's "npm Module Terms and Conditions" — a proprietary, GitHub-governed agreement. The operative clauses for your case:

"1. INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software only with the Visual Studio Code or Code-OSS and successor Microsoft products and services for use with GitHub Copilot. The use with Code-OSS is allowed for development purposes only. No other use is permitted."

"3.e. …You may not: … share, publish, rent or lease the software, except in combining the software with GitHub applications; or f) provide the software as a stand-alone offering or combined with any of your applications for others to use, or transfer the software or this agreement to any third party, except in combining the software with GitHub applications."

So, to your questions:

1. No — the package as a whole doesn't carry uniform redistribution rights. The MIT portions do; @vscode/copilot-api@0.5.2 does not, and code-server is a Code-OSS downstream rather than a "GitHub application."
2. No — there is no exception in those terms covering redistribution by independent cloud providers. Clause 3.f is the one your model most directly trips: distributing images to customers is "provid[ing] the software … combined with any of your applications for others to use."
3. The rights-holder for that component is GitHub, not the code-server maintainers, so the permission path runs through GitHub (their business/licensing contact — the same one npm publishers are pointed to for these module terms). Standard caveat: this is an engineering-community reading of the published text, not legal advice; for a commercial launch your counsel should confirm with GitHub directly.

Two practical directions worth raising in parallel:

• Ask the code-server maintainers whether Copilot support can be made optional. The dependency exists to support GitHub Copilot Chat integration; a build flag or postinstall exclusion that produces a package without @vscode/copilot-api would leave the redistributable artifact fully MIT. That's a legitimate feature request on this repo — your scenario (OS vendors, cloud images, air-gapped distributors) is exactly who it blocks, and it's the cleanest engineering fix for everyone downstream.
• Interim option: distribute your images without code-server's Copilot integration and let customers who hold their own Copilot subscriptions opt in themselves (the customer, not you, then forms the relationship with GitHub's terms). Whether that's workable depends on how entangled the component is at runtime — which is also information the maintainers can give you fastest.

The SHA-256 you pinned is a good detail to keep in whichever thread with the maintainers you open — it makes the licensing question concrete to an exact artifact.