diff --git a/ci/build.ts b/ci/build.ts
index ada4a2cb..649bbe05 100644
--- a/ci/build.ts
+++ b/ci/build.ts
@@ -353,7 +353,7 @@ class Builder {
         hmr: false,
         logLevel: 1,
         outDir: path.join(this.rootPath, out),
-        publicUrl: `/static-${commit || "development"}/dist`,
+        publicUrl: `/static/${commit || "development"}/dist`,
         target: "browser",
       },
     )
diff --git a/ci/vscode.patch b/ci/vscode.patch
index 82197588..54a3a759 100644
--- a/ci/vscode.patch
+++ b/ci/vscode.patch
@@ -2968,7 +2968,7 @@ index bbb72e9511..0785d3391d 100644
 -registerSingleton(IExtensionStoragePaths, class extends NotImplementedProxy(IExtensionStoragePaths) { whenReady = Promise.resolve(); });
 +registerSingleton(IExtensionStoragePaths, ExtensionStoragePaths);
 diff --git a/src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts b/src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts
-index 79455414c0..5ba66b2d83 100644
+index 79455414c0..a407593b4d 100644
 --- a/src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts
 +++ b/src/vs/workbench/services/extensions/worker/extensionHostWorkerMain.ts
 @@ -14,7 +14,11 @@
@@ -2978,8 +2978,8 @@ index 79455414c0..5ba66b2d83 100644
 -		catchError: true
 +		catchError: true,
 +		paths: {
-+			'@coder/node-browser': `../../static-{{COMMIT}}/node_modules/@coder/node-browser/out/client/client.js`,
-+			'@coder/requirefs': `../../static-{{COMMIT}}/node_modules/@coder/requirefs/out/requirefs.js`,
++			'@coder/node-browser': `../node_modules/@coder/node-browser/out/client/client.js`,
++			'@coder/requirefs': `../node_modules/@coder/requirefs/out/requirefs.js`,
 +		}
  	});
 
diff --git a/src/browser/media/manifest.json b/src/browser/media/manifest.json
index c0f5cf23..76ec15ce 100644
--- a/src/browser/media/manifest.json
+++ b/src/browser/media/manifest.json
@@ -7,32 +7,32 @@
   "description": "Run editors on a remote server.",
   "icons": [
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-96.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-96.png",
       "type": "image/png",
       "sizes": "96x96"
     },
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-128.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-128.png",
       "type": "image/png",
       "sizes": "128x128"
     },
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-192.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-192.png",
       "type": "image/png",
       "sizes": "192x192"
     },
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-256.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-256.png",
       "type": "image/png",
       "sizes": "256x256"
     },
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-384.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-384.png",
       "type": "image/png",
       "sizes": "384x384"
     },
     {
-      "src": "{{BASE}}/static-{{COMMIT}}/src/browser/media/pwa-icon-512.png",
+      "src": "{{BASE}}/static/{{COMMIT}}/src/browser/media/pwa-icon-512.png",
       "type": "image/png",
       "sizes": "512x512"
     }
diff --git a/src/browser/pages/app.html b/src/browser/pages/app.html
index 0e850eee..616e303c 100644
--- a/src/browser/pages/app.html
+++ b/src/browser/pages/app.html
@@ -8,18 +8,18 @@
     />
     <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
     <title>code-server — {{APP_NAME}}</title>
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
-    <link href="{{BASE}}/static-{{COMMIT}}/dist/app.css" rel="stylesheet" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
+    <link href="{{BASE}}/static/{{COMMIT}}/dist/app.css" rel="stylesheet" />
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
   </head>
   <body>
-    <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
-    <script src="{{BASE}}/static-{{COMMIT}}/dist/app.js"></script>
+    <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
+    <script src="{{BASE}}/static/{{COMMIT}}/dist/app.js"></script>
   </body>
 </html>
diff --git a/src/browser/pages/error.html b/src/browser/pages/error.html
index e714c922..83dfcbaa 100644
--- a/src/browser/pages/error.html
+++ b/src/browser/pages/error.html
@@ -8,14 +8,14 @@
     />
     <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
     <title>{{ERROR_TITLE}} - code-server</title>
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
-    <link href="{{BASE}}/static-{{COMMIT}}/dist/app.css" rel="stylesheet" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
+    <link href="{{BASE}}/static/{{COMMIT}}/dist/app.css" rel="stylesheet" />
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
   </head>
   <body>
@@ -30,6 +30,6 @@
         </div>
       </div>
     </div>
-    <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
+    <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
   </body>
 </html>
diff --git a/src/browser/pages/home.html b/src/browser/pages/home.html
index d2bc92f7..3a06ec25 100644
--- a/src/browser/pages/home.html
+++ b/src/browser/pages/home.html
@@ -8,14 +8,14 @@
     />
     <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
     <title>code-server</title>
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
-    <link href="{{BASE}}/static-{{COMMIT}}/dist/app.css" rel="stylesheet" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
+    <link href="{{BASE}}/static/{{COMMIT}}/dist/app.css" rel="stylesheet" />
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
   </head>
   <body>
@@ -70,6 +70,6 @@
         </div>
       </div>
     </div>
-    <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
+    <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
   </body>
 </html>
diff --git a/src/browser/pages/login.html b/src/browser/pages/login.html
index df6c890b..9a98d012 100644
--- a/src/browser/pages/login.html
+++ b/src/browser/pages/login.html
@@ -11,14 +11,14 @@
       content="style-src 'self'; script-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:;"
     />
     <title>code-server login</title>
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
-    <link href="{{BASE}}/static-{{COMMIT}}/dist/app.css" rel="stylesheet" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
+    <link href="{{BASE}}/static/{{COMMIT}}/dist/app.css" rel="stylesheet" />
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
   </head>
   <body>
@@ -50,7 +50,7 @@
       </div>
     </div>
   </body>
-  <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
+  <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
   <script>
     const parts = window.location.pathname.replace(/^\//g, "").split("/")
     parts[parts.length - 1] = "{{BASE}}"
diff --git a/src/browser/pages/update.html b/src/browser/pages/update.html
index d29bbead..b55e4791 100644
--- a/src/browser/pages/update.html
+++ b/src/browser/pages/update.html
@@ -8,14 +8,14 @@
     />
     <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
     <title>code-server</title>
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
-    <link href="{{BASE}}/static-{{COMMIT}}/dist/app.css" rel="stylesheet" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
+    <link href="{{BASE}}/static/{{COMMIT}}/dist/app.css" rel="stylesheet" />
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
   </head>
   <body>
@@ -33,6 +33,6 @@
         </div>
       </div>
     </div>
-    <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
+    <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
   </body>
 </html>
diff --git a/src/browser/pages/vscode.html b/src/browser/pages/vscode.html
index c95918c2..fa2b82af 100644
--- a/src/browser/pages/vscode.html
+++ b/src/browser/pages/vscode.html
@@ -25,21 +25,21 @@
     <meta id="vscode-remote-nls-configuration" data-settings="{{NLS_CONFIGURATION}}" />
 
     <!-- Workbench Icon/Manifest/CSS -->
-    <link rel="icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
+    <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
       rel="manifest"
-      href="{{BASE}}/static-{{COMMIT}}/src/browser/media/manifest.json"
+      href="{{BASE}}/static/{{COMMIT}}/src/browser/media/manifest.json"
       crossorigin="use-credentials"
     />
     <!-- PROD_ONLY
-    <link data-name="vs/workbench/workbench.web.api" rel="stylesheet" href="{{VS_BASE}}/static-{{COMMIT}}/out/vs/workbench/workbench.web.api.css">
+    <link data-name="vs/workbench/workbench.web.api" rel="stylesheet" href="{{BASE}}/static/{{COMMIT}}/lib/vscode/out/vs/workbench/workbench.web.api.css">
     END_PROD_ONLY -->
-    <link rel="apple-touch-icon" href="{{BASE}}/static-{{COMMIT}}/src/browser/media/code-server.png" />
+    <link rel="apple-touch-icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/code-server.png" />
     <meta name="apple-mobile-web-app-capable" content="yes" />
 
     <!-- Prefetch to avoid waterfall -->
     <!-- PROD_ONLY
-    <link rel="prefetch" href="{{VS_BASE}}/static-{{COMMIT}}/node_modules/semver-umd/lib/semver-umd.js">
+    <link rel="prefetch" href="{{BASE}}/static/{{COMMIT}}/lib/vscode/node_modules/semver-umd/lib/semver-umd.js">
     END_PROD_ONLY -->
 
     <meta id="coder-options" data-settings="{{OPTIONS}}" />
@@ -50,11 +50,11 @@
   <!-- Startup (do not modify order of script tags!) -->
   <script>
     const parts = window.location.pathname.replace(/^\//g, "").split("/")
-    parts[parts.length - 1] = "{{VS_BASE}}"
+    parts[parts.length - 1] = "{{BASE}}"
     const url = new URL(window.location.origin + "/" + parts.join("/"))
     const el = document.getElementById("vscode-remote-commit")
     const commit = el ? el.getAttribute("data-settings") : ""
-    const staticBase = url.href + "/static-" + commit
+    const staticBase = url.href + "/static/" + commit + "/lib/vscode"
     let nlsConfig
     try {
       nlsConfig = JSON.parse(document.getElementById("vscode-remote-nls-configuration").getAttribute("data-settings"))
@@ -93,11 +93,11 @@
       "vs/nls": nlsConfig,
     }
   </script>
-  <script src="{{BASE}}/static-{{COMMIT}}/dist/register.js"></script>
-  <script src="{{VS_BASE}}/static-{{COMMIT}}/out/vs/loader.js"></script>
+  <script src="{{BASE}}/static/{{COMMIT}}/dist/register.js"></script>
+  <script src="{{BASE}}/static/{{COMMIT}}/lib/vscode/out/vs/loader.js"></script>
   <!-- PROD_ONLY
-  <script src="{{VS_BASE}}/static-{{COMMIT}}/out/vs/workbench/workbench.web.api.nls.js"></script>
-  <script src="{{VS_BASE}}/static-{{COMMIT}}/out/vs/workbench/workbench.web.api.js"></script>
+  <script src="{{BASE}}/static/{{COMMIT}}/lib/vscode/out/vs/workbench/workbench.web.api.nls.js"></script>
+  <script src="{{BASE}}/static/{{COMMIT}}/lib/vscode/out/vs/workbench/workbench.web.api.js"></script>
   END_PROD_ONLY -->
   <script>
     require(["vs/code/browser/workbench/workbench"], function() {})
diff --git a/src/browser/register.ts b/src/browser/register.ts
index cb0d146c..1faff4bb 100644
--- a/src/browser/register.ts
+++ b/src/browser/register.ts
@@ -3,7 +3,7 @@ import { getOptions, normalize } from "../common/util"
 const options = getOptions()
 
 if ("serviceWorker" in navigator) {
-  const path = normalize(`${options.base}/static-${options.commit}/dist/serviceWorker.js`)
+  const path = normalize(`${options.base}/static/${options.commit}/dist/serviceWorker.js`)
   navigator.serviceWorker
     .register(path, {
       scope: options.base || "/",
diff --git a/src/node/app/api.ts b/src/node/app/api.ts
index f3a86680..ab6da9ac 100644
--- a/src/node/app/api.ts
+++ b/src/node/app/api.ts
@@ -16,7 +16,7 @@ import {
   SessionError,
   SessionResponse,
 } from "../../common/api"
-import { ApiEndpoint, HttpCode } from "../../common/http"
+import { ApiEndpoint, HttpCode, HttpError } from "../../common/http"
 import { normalize } from "../../common/util"
 import { HttpProvider, HttpProviderOptions, HttpResponse, HttpServer, Route } from "../http"
 import { findApplications, findWhitelistedApplications, Vscode } from "./bin"
@@ -57,10 +57,9 @@ export class ApiHttpProvider extends HttpProvider {
     })
   }
 
-  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse | undefined> {
-    if (!this.authenticated(request)) {
-      return { code: HttpCode.Unauthorized }
-    }
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
+    this.ensureAuthenticated(request)
+
     switch (route.base) {
       case ApiEndpoint.applications:
         this.ensureMethod(request)
@@ -82,7 +81,8 @@ export class ApiHttpProvider extends HttpProvider {
           content: await this.running(),
         } as HttpResponse<RunningResponse>
     }
-    return undefined
+
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   public async handleWebSocket(
@@ -90,7 +90,7 @@ export class ApiHttpProvider extends HttpProvider {
     request: http.IncomingMessage,
     socket: net.Socket,
     head: Buffer,
-  ): Promise<true | undefined> {
+  ): Promise<true> {
     if (!this.authenticated(request)) {
       throw new Error("not authenticated")
     }
@@ -100,7 +100,8 @@ export class ApiHttpProvider extends HttpProvider {
       case ApiEndpoint.run:
         return this.handleRunSocket(route, request, socket, head)
     }
-    return undefined
+
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   private async handleStatusSocket(request: http.IncomingMessage, socket: net.Socket, head: Buffer): Promise<true> {
@@ -220,12 +221,12 @@ export class ApiHttpProvider extends HttpProvider {
   /**
    * Handle /session endpoint.
    */
-  private async session(request: http.IncomingMessage): Promise<HttpResponse | undefined> {
+  private async session(request: http.IncomingMessage): Promise<HttpResponse> {
     this.ensureMethod(request, ["DELETE", "POST"])
 
     const data = await this.getData(request)
     if (!data) {
-      return undefined
+      throw new HttpError("Not found", HttpCode.NotFound)
     }
 
     switch (request.method) {
@@ -252,7 +253,7 @@ export class ApiHttpProvider extends HttpProvider {
       }
     }
 
-    return undefined
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   /**
diff --git a/src/node/app/app.ts b/src/node/app/app.ts
index 8f75cc2b..c115f7e8 100644
--- a/src/node/app/app.ts
+++ b/src/node/app/app.ts
@@ -1,51 +1,19 @@
 import * as http from "http"
-import * as querystring from "querystring"
-import { Application, RecentResponse } from "../../common/api"
 import { HttpCode, HttpError } from "../../common/http"
 import { HttpProvider, HttpProviderOptions, HttpResponse, Route } from "../http"
 import { ApiHttpProvider } from "./api"
-import { UpdateHttpProvider } from "./update"
 
 /**
- * Top-level and fallback HTTP provider.
+ * App/fallback HTTP provider.
  */
-export class MainHttpProvider extends HttpProvider {
-  public constructor(
-    options: HttpProviderOptions,
-    private readonly api: ApiHttpProvider,
-    private readonly update: UpdateHttpProvider,
-  ) {
+export class AppHttpProvider extends HttpProvider {
+  public constructor(options: HttpProviderOptions, private readonly api: ApiHttpProvider) {
     super(options)
   }
 
-  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse | undefined> {
-    switch (route.base) {
-      case "/static": {
-        this.ensureMethod(request)
-        const response = await this.getReplacedResource(route)
-        if (!this.isDev) {
-          response.cache = true
-        }
-        return response
-      }
-
-      case "/delete": {
-        this.ensureMethod(request, "POST")
-        const data = await this.getData(request)
-        const p = data ? querystring.parse(data) : {}
-        this.api.deleteSession(p.sessionId as string)
-        return { redirect: "/" }
-      }
-
-      case "/": {
-        this.ensureMethod(request)
-        if (route.requestPath !== "/index.html") {
-          throw new HttpError("Not found", HttpCode.NotFound)
-        } else if (!this.authenticated(request)) {
-          return { redirect: "/login" }
-        }
-        return this.getRoot(route)
-      }
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
+    if (!this.authenticated(request)) {
+      return { redirect: "/login", query: { to: route.fullPath } }
     }
 
     // Run an existing app, but if it doesn't exist go ahead and start it.
@@ -53,7 +21,7 @@ export class MainHttpProvider extends HttpProvider {
     let sessionId = app && app.sessionId
     if (!app) {
       app = (await this.api.installedApplications()).find((a) => a.path === route.base)
-      if (app) {
+      if (app && app.exec) {
         sessionId = await this.api.createSession(app)
       }
     }
@@ -62,40 +30,7 @@ export class MainHttpProvider extends HttpProvider {
       return this.getAppRoot(route, (app && app.name) || "", sessionId)
     }
 
-    return this.getErrorRoot(route, "404", "404", "Application not found")
-  }
-
-  /**
-   * Return a resource with variables replaced where necessary.
-   */
-  protected async getReplacedResource(route: Route): Promise<HttpResponse> {
-    const split = route.requestPath.split("/")
-    switch (split[split.length - 1]) {
-      case "manifest.json": {
-        const response = await this.getUtf8Resource(this.rootPath, route.requestPath)
-        return this.replaceTemplates(route, response)
-      }
-    }
-    return this.getResource(this.rootPath, route.requestPath)
-  }
-
-  public async getRoot(route: Route): Promise<HttpResponse> {
-    const running = await this.api.running()
-    const apps = await this.api.installedApplications()
-    const response = await this.getUtf8Resource(this.rootPath, "src/browser/pages/home.html")
-    response.content = response.content
-      .replace(/{{UPDATE:NAME}}/, await this.getUpdate())
-      .replace(/{{APP_LIST:RUNNING}}/, this.getAppRows(running.applications))
-      .replace(/{{APP_LIST:RECENT_PROJECTS}}/, this.getRecentProjectRows(await this.api.recent()))
-      .replace(
-        /{{APP_LIST:EDITORS}}/,
-        this.getAppRows(apps.filter((app) => app.categories && app.categories.includes("Editor"))),
-      )
-      .replace(
-        /{{APP_LIST:OTHER}}/,
-        this.getAppRows(apps.filter((app) => !app.categories || !app.categories.includes("Editor"))),
-      )
-    return this.replaceTemplates(route, response)
+    throw new HttpError("Application not found", HttpCode.NotFound)
   }
 
   public async getAppRoot(route: Route, name: string, sessionId: string): Promise<HttpResponse> {
@@ -104,91 +39,7 @@ export class MainHttpProvider extends HttpProvider {
     return this.replaceTemplates(route, response, sessionId)
   }
 
-  public async handleWebSocket(): Promise<undefined> {
-    return undefined
-  }
-
-  private getRecentProjectRows(recents: RecentResponse): string {
-    return recents.paths.length > 0 || recents.workspaces.length > 0
-      ? recents.paths.map((recent) => this.getRecentProjectRow(recent)).join("\n") +
-          recents.workspaces.map((recent) => this.getRecentProjectRow(recent, true)).join("\n")
-      : `<div class="none">No recent directories or workspaces.</div>`
-  }
-
-  private getRecentProjectRow(recent: string, workspace?: boolean): string {
-    return `<div class="block-row">
-      <a class="item -row -link" href="./vscode/?${workspace ? "workspace" : "folder"}=${recent}">
-        <div class="name">${recent}${workspace ? " (workspace)" : ""}</div>
-      </a>
-    </div>`
-  }
-
-  private getAppRows(apps: ReadonlyArray<Application>): string {
-    return apps.length > 0
-      ? apps.map((app) => this.getAppRow(app)).join("\n")
-      : `<div class="none">No applications are currently running.</div>`
-  }
-
-  private getAppRow(app: Application): string {
-    return `<div class="block-row">
-      <a class="item -row -link" href=".${app.path}">
-        ${
-          app.icon
-            ? `<img class="icon" src="data:image/png;base64,${app.icon}"></img>`
-            : `<div class="icon -missing"></div>`
-        }
-        <div class="name">${app.name}</div>
-      </a>
-      ${
-        app.sessionId
-          ? `<form class="kill-form" action="./delete" method="POST">
-               <input type="hidden" name="sessionId" value="${app.sessionId}">
-               <button class="kill -button" type="submit">Kill</button>
-             </form>`
-          : ""
-      }
-    </div>`
-  }
-
-  private async getUpdate(): Promise<string> {
-    if (!this.update.enabled) {
-      return `<div class="block-row"><div class="item"><div class="sub">Updates are disabled</div></div></div>`
-    }
-
-    const humanize = (time: number): string => {
-      const d = new Date(time)
-      const pad = (t: number): string => (t < 10 ? "0" : "") + t
-      return (
-        `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}` +
-        ` ${pad(d.getHours())}:${pad(d.getMinutes())}`
-      )
-    }
-
-    const update = await this.update.getUpdate()
-    if (this.update.isLatestVersion(update)) {
-      return `<div class="block-row">
-        <div class="item">
-          Latest: ${update.version}
-          <div class="sub">Up to date</div>
-        </div>
-        <div class="item">
-          ${humanize(update.checked)}
-          <a class="sub -link" href="./update/check">Check now</a>
-        </div>
-        <div class="item" >Current: ${this.update.currentVersion}</div>
-      </div>`
-    }
-
-    return `<div class="block-row">
-      <div class="item">
-        Latest: ${update.version}
-        <div class="sub">Out of date</div>
-      </div>
-      <div class="item">
-        ${humanize(update.checked)}
-        <a class="sub -link" href="./update">Update now</a>
-      </div>
-      <div class="item" >Current: ${this.update.currentVersion}</div>
-    </div>`
+  public async handleWebSocket(): Promise<true> {
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 }
diff --git a/src/node/app/bin.ts b/src/node/app/bin.ts
index b278e3fe..f12ce3a2 100644
--- a/src/node/app/bin.ts
+++ b/src/node/app/bin.ts
@@ -15,7 +15,7 @@ export const Vscode: Application = {
   icon: fs.readFileSync(path.resolve(__dirname, "../../../lib/vscode/resources/linux/code.png")).toString("base64"),
   installed: true,
   name: "VS Code",
-  path: "/vscode",
+  path: "/",
   version: getVscodeVersion(),
 }
 
diff --git a/src/node/app/dashboard.ts b/src/node/app/dashboard.ts
new file mode 100644
index 00000000..106834a0
--- /dev/null
+++ b/src/node/app/dashboard.ts
@@ -0,0 +1,159 @@
+import * as http from "http"
+import * as querystring from "querystring"
+import { Application, RecentResponse } from "../../common/api"
+import { HttpCode, HttpError } from "../../common/http"
+import { HttpProvider, HttpProviderOptions, HttpResponse, Route } from "../http"
+import { ApiHttpProvider } from "./api"
+import { Vscode } from "./bin"
+import { UpdateHttpProvider } from "./update"
+
+/**
+ * Dashboard HTTP provider.
+ */
+export class DashboardHttpProvider extends HttpProvider {
+  public constructor(
+    options: HttpProviderOptions,
+    private readonly api: ApiHttpProvider,
+    private readonly update: UpdateHttpProvider,
+  ) {
+    super(options)
+  }
+
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
+    switch (route.base) {
+      case "/delete": {
+        this.ensureMethod(request, "POST")
+        this.ensureAuthenticated(request)
+        const data = await this.getData(request)
+        const p = data ? querystring.parse(data) : {}
+        this.api.deleteSession(p.sessionId as string)
+        return { redirect: this.options.base }
+      }
+
+      case "/": {
+        this.ensureMethod(request)
+        if (route.requestPath !== "/index.html") {
+          throw new HttpError("Not found", HttpCode.NotFound)
+        } else if (!this.authenticated(request)) {
+          return { redirect: "/login", query: { to: this.options.base } }
+        }
+        return this.getRoot(route)
+      }
+    }
+
+    throw new HttpError("Not found", HttpCode.NotFound)
+  }
+
+  public async getRoot(route: Route): Promise<HttpResponse> {
+    const base = this.base(route)
+    const apps = await this.api.installedApplications()
+    const response = await this.getUtf8Resource(this.rootPath, "src/browser/pages/home.html")
+    response.content = response.content
+      .replace(/{{UPDATE:NAME}}/, await this.getUpdate(base))
+      .replace(/{{APP_LIST:RUNNING}}/, this.getAppRows(base, (await this.api.running()).applications))
+      .replace(/{{APP_LIST:RECENT_PROJECTS}}/, this.getRecentProjectRows(base, await this.api.recent()))
+      .replace(
+        /{{APP_LIST:EDITORS}}/,
+        this.getAppRows(
+          base,
+          apps.filter((app) => app.categories && app.categories.includes("Editor")),
+        ),
+      )
+      .replace(
+        /{{APP_LIST:OTHER}}/,
+        this.getAppRows(
+          base,
+          apps.filter((app) => !app.categories || !app.categories.includes("Editor")),
+        ),
+      )
+    return this.replaceTemplates(route, response)
+  }
+
+  public async handleWebSocket(): Promise<true> {
+    throw new HttpError("Not found", HttpCode.NotFound)
+  }
+
+  private getRecentProjectRows(base: string, recents: RecentResponse): string {
+    return recents.paths.length > 0 || recents.workspaces.length > 0
+      ? recents.paths.map((recent) => this.getRecentProjectRow(base, recent)).join("\n") +
+          recents.workspaces.map((recent) => this.getRecentProjectRow(base, recent, true)).join("\n")
+      : `<div class="none">No recent directories or workspaces.</div>`
+  }
+
+  private getRecentProjectRow(base: string, recent: string, workspace?: boolean): string {
+    return `<div class="block-row">
+      <a class="item -row -link" href="${base}${Vscode.path}?${workspace ? "workspace" : "folder"}=${recent}">
+        <div class="name">${recent}${workspace ? " (workspace)" : ""}</div>
+      </a>
+    </div>`
+  }
+
+  private getAppRows(base: string, apps: ReadonlyArray<Application>): string {
+    return apps.length > 0
+      ? apps.map((app) => this.getAppRow(base, app)).join("\n")
+      : `<div class="none">No applications are currently running.</div>`
+  }
+
+  private getAppRow(base: string, app: Application): string {
+    return `<div class="block-row">
+      <a class="item -row -link" href="${base}${app.path}">
+        ${
+          app.icon
+            ? `<img class="icon" src="data:image/png;base64,${app.icon}"></img>`
+            : `<div class="icon -missing"></div>`
+        }
+        <div class="name">${app.name}</div>
+      </a>
+      ${
+        app.sessionId
+          ? `<form class="kill-form" action="${base}${this.options.base}/delete" method="POST">
+               <input type="hidden" name="sessionId" value="${app.sessionId}">
+               <button class="kill -button" type="submit">Kill</button>
+             </form>`
+          : ""
+      }
+    </div>`
+  }
+
+  private async getUpdate(base: string): Promise<string> {
+    if (!this.update.enabled) {
+      return `<div class="block-row"><div class="item"><div class="sub">Updates are disabled</div></div></div>`
+    }
+
+    const humanize = (time: number): string => {
+      const d = new Date(time)
+      const pad = (t: number): string => (t < 10 ? "0" : "") + t
+      return (
+        `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}` +
+        ` ${pad(d.getHours())}:${pad(d.getMinutes())}`
+      )
+    }
+
+    const update = await this.update.getUpdate()
+    if (this.update.isLatestVersion(update)) {
+      return `<div class="block-row">
+        <div class="item">
+          Latest: ${update.version}
+          <div class="sub">Up to date</div>
+        </div>
+        <div class="item">
+          ${humanize(update.checked)}
+          <a class="sub -link" href="${base}/update/check?to=${this.options.base}">Check now</a>
+        </div>
+        <div class="item" >Current: ${this.update.currentVersion}</div>
+      </div>`
+    }
+
+    return `<div class="block-row">
+      <div class="item">
+        Latest: ${update.version}
+        <div class="sub">Out of date</div>
+      </div>
+      <div class="item">
+        ${humanize(update.checked)}
+        <a class="sub -link" href="${base}/update">Update now</a>
+      </div>
+      <div class="item" >Current: ${this.update.currentVersion}</div>
+    </div>`
+  }
+}
diff --git a/src/node/app/login.ts b/src/node/app/login.ts
index 8dbcd020..14bc4d7c 100644
--- a/src/node/app/login.ts
+++ b/src/node/app/login.ts
@@ -17,7 +17,7 @@ interface LoginPayload {
  * Login HTTP provider.
  */
 export class LoginHttpProvider extends HttpProvider {
-  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse | undefined> {
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
     if (this.options.auth !== AuthType.Password) {
       throw new HttpError("Not found", HttpCode.NotFound)
     }
@@ -42,7 +42,7 @@ export class LoginHttpProvider extends HttpProvider {
         }
     }
 
-    return undefined
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   public async getRoot(route: Route, error?: Error): Promise<HttpResponse> {
diff --git a/src/node/app/static.ts b/src/node/app/static.ts
new file mode 100644
index 00000000..fc2cacd2
--- /dev/null
+++ b/src/node/app/static.ts
@@ -0,0 +1,39 @@
+import * as http from "http"
+import { HttpCode, HttpError } from "../../common/http"
+import { HttpProvider, HttpResponse, Route } from "../http"
+
+/**
+ * Static file HTTP provider. Static requests do not require authentication and
+ * they only allow access to resources within the application.
+ */
+export class StaticHttpProvider extends HttpProvider {
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
+    this.ensureMethod(request)
+    const response = await this.getReplacedResource(route)
+    if (!this.isDev) {
+      response.cache = true
+    }
+    return response
+  }
+
+  /**
+   * Return a resource with variables replaced where necessary.
+   */
+  protected async getReplacedResource(route: Route): Promise<HttpResponse> {
+    // The first part is always the commit (for caching purposes).
+    const split = route.requestPath.split("/").slice(1)
+
+    switch (split[split.length - 1]) {
+      case "manifest.json":
+      case "extensionHostWorkerMain.js": {
+        const response = await this.getUtf8Resource(this.rootPath, ...split)
+        return this.replaceTemplates(route, response)
+      }
+    }
+    return this.getResource(this.rootPath, ...split)
+  }
+
+  public async handleWebSocket(): Promise<true> {
+    throw new HttpError("Not found", HttpCode.NotFound)
+  }
+}
diff --git a/src/node/app/update.ts b/src/node/app/update.ts
index 212f5a01..19f8b240 100644
--- a/src/node/app/update.ts
+++ b/src/node/app/update.ts
@@ -57,18 +57,24 @@ export class UpdateHttpProvider extends HttpProvider {
     super(options)
   }
 
-  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse | undefined> {
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
+    this.ensureAuthenticated(request)
+
     switch (route.base) {
       case "/check":
         this.ensureMethod(request)
         this.getUpdate(true)
-        return { redirect: "/login" }
+        if (route.query && route.query.to) {
+          return {
+            redirect: Array.isArray(route.query.to) ? route.query.to[0] : route.query.to,
+            query: { to: undefined },
+          }
+        }
+        return this.getRoot(route)
       case "/": {
         this.ensureMethod(request, ["GET", "POST"])
         if (route.requestPath !== "/index.html") {
           throw new HttpError("Not found", HttpCode.NotFound)
-        } else if (!this.authenticated(request)) {
-          return { redirect: "/login" }
         }
 
         switch (request.method) {
@@ -80,7 +86,7 @@ export class UpdateHttpProvider extends HttpProvider {
       }
     }
 
-    return undefined
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   public async getRoot(route: Route, error?: Error): Promise<HttpResponse> {
@@ -91,8 +97,8 @@ export class UpdateHttpProvider extends HttpProvider {
     return this.replaceTemplates(route, response)
   }
 
-  public async handleWebSocket(): Promise<undefined> {
-    return undefined
+  public async handleWebSocket(): Promise<true> {
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   /**
@@ -166,13 +172,10 @@ export class UpdateHttpProvider extends HttpProvider {
   public async tryUpdate(route: Route): Promise<HttpResponse> {
     try {
       const update = await this.getUpdate()
-      if (this.isLatestVersion(update)) {
-        throw new Error("no update available")
-      }
-      await this.downloadUpdate(update)
-      return {
-        redirect: (Array.isArray(route.query.to) ? route.query.to[0] : route.query.to) || "/",
+      if (!this.isLatestVersion(update)) {
+        await this.downloadUpdate(update)
       }
+      return this.getRoot(route)
     } catch (error) {
       return this.getRoot(route, error)
     }
diff --git a/src/node/app/vscode.ts b/src/node/app/vscode.ts
index f6fa4f4c..f191faf6 100644
--- a/src/node/app/vscode.ts
+++ b/src/node/app/vscode.ts
@@ -23,7 +23,6 @@ export class VscodeHttpProvider extends HttpProvider {
   private readonly serverRootPath: string
   private readonly vsRootPath: string
   private _vscode?: Promise<cp.ChildProcess>
-  private workbenchOptions?: WorkbenchOptions
 
   public constructor(options: HttpProviderOptions, private readonly args: Args) {
     super(options)
@@ -124,7 +123,7 @@ export class VscodeHttpProvider extends HttpProvider {
     vscode.send(message, socket)
   }
 
-  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse | undefined> {
+  public async handleRequest(route: Route, request: http.IncomingMessage): Promise<HttpResponse> {
     this.ensureMethod(request)
 
     switch (route.base) {
@@ -150,22 +149,6 @@ export class VscodeHttpProvider extends HttpProvider {
     this.ensureAuthenticated(request)
 
     switch (route.base) {
-      case "/static": {
-        switch (route.requestPath) {
-          case "/out/vs/workbench/services/extensions/worker/extensionHostWorkerMain.js": {
-            const response = await this.getUtf8Resource(this.vsRootPath, route.requestPath)
-            response.content = response.content.replace(
-              /{{COMMIT}}/g,
-              this.workbenchOptions ? this.workbenchOptions.commit : "",
-            )
-            response.cache = true
-            return response
-          }
-        }
-        const response = await this.getResource(this.vsRootPath, route.requestPath)
-        response.cache = true
-        return response
-      }
       case "/resource":
       case "/vscode-remote-resource":
         if (typeof route.query.path === "string") {
@@ -183,7 +166,8 @@ export class VscodeHttpProvider extends HttpProvider {
         }
         return this.getResource(this.vsRootPath, "out/vs/workbench/contrib/webview/browser/pre", route.requestPath)
     }
-    return undefined
+
+    throw new HttpError("Not found", HttpCode.NotFound)
   }
 
   private async getRoot(request: http.IncomingMessage, route: Route): Promise<HttpResponse> {
@@ -207,8 +191,6 @@ export class VscodeHttpProvider extends HttpProvider {
       }),
     ])
 
-    this.workbenchOptions = options
-
     if (startPath) {
       settings.write({
         lastVisited: startPath,
@@ -220,7 +202,6 @@ export class VscodeHttpProvider extends HttpProvider {
     }
 
     response.content = response.content
-      .replace(/{{VS_BASE}}/g, this.base(route) + this.options.base)
       .replace(`"{{REMOTE_USER_DATA_URI}}"`, `'${JSON.stringify(options.remoteUserDataUri)}'`)
       .replace(`"{{PRODUCT_CONFIGURATION}}"`, `'${JSON.stringify(options.productConfiguration)}'`)
       .replace(`"{{WORKBENCH_WEB_CONFIGURATION}}"`, `'${JSON.stringify(options.workbenchWebConfiguration)}'`)
diff --git a/src/node/entry.ts b/src/node/entry.ts
index a19ac886..3d9f6c49 100644
--- a/src/node/entry.ts
+++ b/src/node/entry.ts
@@ -3,8 +3,10 @@ import * as cp from "child_process"
 import * as path from "path"
 import { CliMessage } from "../../lib/vscode/src/vs/server/ipc"
 import { ApiHttpProvider } from "./app/api"
-import { MainHttpProvider } from "./app/app"
+import { AppHttpProvider } from "./app/app"
+import { DashboardHttpProvider } from "./app/dashboard"
 import { LoginHttpProvider } from "./app/login"
+import { StaticHttpProvider } from "./app/static"
 import { UpdateHttpProvider } from "./app/update"
 import { VscodeHttpProvider } from "./app/vscode"
 import { Args, optionDescriptions, parse } from "./cli"
@@ -44,11 +46,13 @@ const main = async (args: Args): Promise<void> => {
   }
 
   const httpServer = new HttpServer(options)
-  const vscode = httpServer.registerHttpProvider("/vscode", VscodeHttpProvider, args)
+  const vscode = httpServer.registerHttpProvider("/", VscodeHttpProvider, args)
   const api = httpServer.registerHttpProvider("/api", ApiHttpProvider, httpServer, vscode, args["user-data-dir"])
   const update = httpServer.registerHttpProvider("/update", UpdateHttpProvider, !args["disable-updates"])
+  httpServer.registerHttpProvider("/app", AppHttpProvider, api)
   httpServer.registerHttpProvider("/login", LoginHttpProvider)
-  httpServer.registerHttpProvider("/", MainHttpProvider, api, update)
+  httpServer.registerHttpProvider("/static", StaticHttpProvider)
+  httpServer.registerHttpProvider("/dashboard", DashboardHttpProvider, api, update)
 
   ipcMain().onDispose(() => httpServer.dispose())
 
diff --git a/src/node/http.ts b/src/node/http.ts
index e2f36156..29442724 100644
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -655,13 +655,6 @@ export class HttpServer {
         base = "/"
       }
       requestPath = requestPath || "/index.html"
-      // Allow for a versioned static endpoint. This lets us cache every static
-      // resource underneath the path based on the version without any work and
-      // without adding query parameters which have their own issues.
-      if (/^\/static-/.test(base)) {
-        base = "/static"
-      }
-
       return { base, requestPath }
     }