@codingame/monaco-vscode-api 33.0.9 → 34.0.0

package/vscode/src/vs/platform/request/common/request.js

@@ -63,6 +63,24 @@ function isClientError(context) {
 function isServerError(context) {
     return !!context.res.statusCode && context.res.statusCode >= 500 && context.res.statusCode < 600;
 }
+function readHeader(headers, name) {
+    if (!headers) {
+        return undefined;
+    }
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(value)) {
+        return value[0];
+    }
+    return value;
+}
+function retryAfterFromHeaders(headers) {
+    const value = readHeader(headers, "retry-after");
+    if (!value) {
+        return undefined;
+    }
+    const parsed = parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
 function hasNoContent(context) {
     return context.res.statusCode === 204;
 }
@@ -123,7 +141,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
     proxyConfiguration = [{
         id: "http",
         order: 15,
-        title: ( localize(2126, "HTTP")),
+        title: ( localize(2156, "HTTP")),
         type: "object",
         scope: ConfigurationScope.MACHINE,
         properties: {
@@ -131,7 +149,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: useHostProxyDefault,
                 markdownDescription: ( localize(
-                    2127,
+                    2157,
                     "Controls whether in the remote extension host the local proxy configuration should be used. This setting only applies as a remote setting during [remote development](https://aka.ms/vscode-remote)."
                 )),
                 restricted: true
@@ -140,7 +158,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
     }, {
         id: "http",
         order: 15,
-        title: ( localize(2126, "HTTP")),
+        title: ( localize(2156, "HTTP")),
         type: "object",
         scope: ConfigurationScope.APPLICATION,
         properties: {
@@ -148,7 +166,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: false,
                 description: ( localize(
-                    2128,
+                    2158,
                     "Controls whether use of Electron's fetch implementation instead of Node.js' should be enabled. All local extensions will get Electron's fetch implementation for the global fetch API."
                 )),
                 restricted: true
@@ -157,7 +175,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
     }, {
         id: "http",
         order: 15,
-        title: ( localize(2126, "HTTP")),
+        title: ( localize(2156, "HTTP")),
         type: "object",
         scope: useHostProxy ? ConfigurationScope.APPLICATION : ConfigurationScope.MACHINE,
         properties: {
@@ -165,7 +183,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "string",
                 pattern: "^(https?|socks|socks4a?|socks5h?)://([^:]*(:[^@]*)?@)?([^:]+|\\[[:0-9a-fA-F]+\\])(:\\d+)?/?$|^$",
                 markdownDescription: ( localize(
-                    2129,
+                    2159,
                     "The proxy setting to use. If not set, will be inherited from the `http_proxy` and `https_proxy` environment variables. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -175,7 +193,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: true,
                 markdownDescription: ( localize(
-                    2130,
+                    2160,
                     "Controls whether the proxy server certificate should be verified against the list of supplied CAs. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -184,7 +202,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
             "http.proxyKerberosServicePrincipal": {
                 type: "string",
                 markdownDescription: ( localize(
-                    2131,
+                    2161,
                     "Overrides the principal service name for Kerberos authentication with the HTTP proxy. A default based on the proxy hostname is used when this is not set. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -196,7 +214,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                     type: "string"
                 },
                 markdownDescription: ( localize(
-                    2132,
+                    2162,
                     "Specifies domain names for which proxy settings should be ignored for HTTP/HTTPS requests. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -206,7 +224,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: ["null", "string"],
                 default: null,
                 markdownDescription: ( localize(
-                    2133,
+                    2163,
                     "The value to send as the `Proxy-Authorization` header for every network request. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -215,13 +233,13 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
             "http.proxySupport": {
                 type: "string",
                 enum: ["off", "on", "fallback", "override"],
-                enumDescriptions: [( localize(2134, "Disable proxy support for extensions.")), ( localize(2135, "Enable proxy support for extensions.")), ( localize(
-                    2136,
+                enumDescriptions: [( localize(2164, "Disable proxy support for extensions.")), ( localize(2165, "Enable proxy support for extensions.")), ( localize(
+                    2166,
                     "Enable proxy support for extensions, fall back to request options, when no proxy found."
-                )), ( localize(2137, "Enable proxy support for extensions, override request options."))],
+                )), ( localize(2167, "Enable proxy support for extensions, override request options."))],
                 default: "override",
                 markdownDescription: ( localize(
-                    2138,
+                    2168,
                     "Use the proxy support for extensions. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -231,7 +249,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: true,
                 markdownDescription: ( localize(
-                    2139,
+                    2169,
                     "Controls whether CA certificates should be loaded from the OS. On Windows and macOS, a reload of the window is required after turning this off. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -242,7 +260,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 tags: ["experimental"],
                 default: systemCertificatesNodeDefault,
                 markdownDescription: ( localize(
-                    2140,
+                    2170,
                     "Controls whether system certificates should be loaded using Node.js built-in support. Reload the window after changing this setting. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -256,7 +274,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 tags: ["experimental"],
                 default: false,
                 markdownDescription: ( localize(
-                    2141,
+                    2171,
                     "Controls whether experimental loading of CA certificates from the OS should be enabled. This uses a more general approach than the default implementation. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -266,7 +284,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: true,
                 markdownDescription: ( localize(
-                    2142,
+                    2172,
                     "Controls whether Node.js' fetch implementation should be extended with additional support. Currently proxy support ({1}) and system certificates ({2}) are added when the corresponding settings are enabled. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`",
                     "`#http.proxySupport#`",
@@ -278,7 +296,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 type: "boolean",
                 default: true,
                 markdownDescription: ( localize(
-                    2143,
+                    2173,
                     "Controls whether the built-in WebSocket implementation should be extended with additional support. Currently proxy support ({1}) and system certificates ({2}) are added when the corresponding settings are enabled. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`",
                     "`#http.proxySupport#`",
@@ -292,7 +310,7 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
                 minimum: -1,
                 tags: ["experimental"],
                 markdownDescription: ( localize(
-                    2144,
+                    2174,
                     "Controls the interval in seconds for checking network interface changes to invalidate the proxy cache. Set to -1 to disable. When during [remote development](https://aka.ms/vscode-remote) the {0} setting is disabled this setting can be configured in the local and the remote settings separately.",
                     "`#http.useLocalProxyConfiguration#`"
                 )),
@@ -310,4 +328,4 @@ function registerProxyConfigurations(useHostProxy = true, useHostProxyDefault =
 }
 registerProxyConfigurations();
 
-export { AbstractRequestService, NO_FETCH_TELEMETRY, USER_LOCAL_AND_REMOTE_SETTINGS, asJson, asText, asTextOrError, hasNoContent, isClientError, isServerError, isSuccess, systemCertificatesNodeDefault };
+export { AbstractRequestService, NO_FETCH_TELEMETRY, USER_LOCAL_AND_REMOTE_SETTINGS, asJson, asText, asTextOrError, hasNoContent, isClientError, isServerError, isSuccess, readHeader, retryAfterFromHeaders, systemCertificatesNodeDefault };

package/vscode/src/vs/platform/sandbox/common/sandboxHelperService.d.ts

@@ -2,3 +2,90 @@ export interface ISandboxDependencyStatus {
     readonly bubblewrapInstalled: boolean;
     readonly socatInstalled: boolean;
 }
+export interface IWindowsMxcFilesystemPolicy {
+    readonly readonlyPaths: string[];
+    readonly readwritePaths: string[];
+}
+/** Sandbox policy passed to the Windows MXC helper process. */
+export interface IWindowsMxcSandboxPolicy {
+    version: string;
+    filesystem?: {
+        readwritePaths?: string[];
+        readonlyPaths?: string[];
+        deniedPaths?: string[];
+        clearPolicyOnExit?: boolean;
+    };
+    network?: {
+        allowOutbound?: boolean;
+        allowLocalNetwork?: boolean;
+        allowedHosts?: string[];
+        blockedHosts?: string[];
+        proxy?: {
+            builtinTestServer: true;
+        } | {
+            localhost: number;
+        } | {
+            url: string;
+        };
+    };
+    ui?: {
+        allowWindows?: boolean;
+        clipboard?: "none" | "read" | "write" | "all";
+        allowInputInjection?: boolean;
+    };
+    timeoutMs?: number;
+}
+/** MXC payload returned by the Windows sandbox helper. */
+export interface IWindowsMxcConfig {
+    version: string;
+    containerId?: string;
+    containment?: IWindowsMxcPolicyContainment;
+    lifecycle?: {
+        destroyOnExit?: boolean;
+        preservePolicy?: boolean;
+    };
+    process?: {
+        commandLine: string;
+        cwd?: string;
+        env?: string[];
+        timeout?: number;
+    };
+    processContainer?: {
+        name?: string;
+        leastPrivilege?: boolean;
+        capabilities?: string[];
+        ui?: {
+            isolation: "desktop" | "handles" | "atoms" | "container";
+            desktopSystemControl: boolean;
+            systemSettings: string;
+            ime: boolean;
+        };
+    };
+    filesystem?: {
+        readwritePaths?: string[];
+        readonlyPaths?: string[];
+        deniedPaths?: string[];
+        clearPolicyOnExit?: boolean;
+    };
+    network?: {
+        enforcementMode?: "capabilities" | "firewall" | "both";
+        defaultPolicy?: "allow" | "block";
+        allowLocalNetwork?: boolean;
+        allowedHosts?: string[];
+        blockedHosts?: string[];
+        proxy?: {
+            builtinTestServer: true;
+        } | {
+            localhost: number;
+        } | {
+            url: string;
+        };
+        removeRulesOnExit?: boolean;
+    };
+    ui?: {
+        disable: boolean;
+        clipboard: "none" | "read" | "write" | "all";
+        injection: boolean;
+    };
+}
+export type IWindowsMxcPolicyContainment = "process" | "vm" | "microvm" | "processcontainer" | "windows_sandbox" | "wslc" | "lxc" | "hyperlight" | "seatbelt" | "isolation_session" | "bubblewrap";

package/vscode/src/vs/platform/sandbox/common/sandboxHelperService.service.d.ts

@@ -1,6 +1,9 @@
-import { ISandboxDependencyStatus } from "./sandboxHelperService.js";
+import { ISandboxDependencyStatus, IWindowsMxcFilesystemPolicy, IWindowsMxcSandboxPolicy, IWindowsMxcPolicyContainment, IWindowsMxcConfig } from "./sandboxHelperService.js";
 export declare const ISandboxHelperService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<ISandboxHelperService>;
 export interface ISandboxHelperService {
     readonly _serviceBrand: undefined;
     checkSandboxDependencies(): Promise<ISandboxDependencyStatus | undefined>;
+    getWindowsMxcFilesystemPolicy(): Promise<IWindowsMxcFilesystemPolicy | undefined>;
+    getWindowsMxcEnvironment(): Promise<string[] | undefined>;
+    buildWindowsMxcSandboxPayload(commandLine: string, policy: IWindowsMxcSandboxPolicy, workingDirectory?: string, containerName?: string, containment?: IWindowsMxcPolicyContainment): Promise<IWindowsMxcConfig | undefined>;
 }

package/vscode/src/vs/platform/sandbox/common/settings.d.ts

@@ -3,10 +3,19 @@
  */
 export declare enum AgentSandboxSettingId {
     AgentSandboxEnabled = "chat.agent.sandbox.enabled",
+    AgentSandboxWindowsEnabled = "chat.agent.sandbox.enabledWindows",
     AgentSandboxAllowUnsandboxedCommands = "chat.agent.sandbox.allowUnsandboxedCommands",
+    AgentSandboxRetryWithAllowNetworkRequests = "chat.agent.sandbox.retryWithAllowNetworkRequests",
     AgentSandboxAutoApproveUnsandboxedCommands = "chat.agent.sandbox.autoApproveUnsandboxedCommands",
     AgentSandboxAllowAutoApprove = "chat.agent.sandbox.allowAutoApprove",
-    DeprecatedAgentSandboxEnabled = "chat.agent.sandbox"
+    AgentSandboxLinuxFileSystem = "chat.agent.sandbox.fileSystem.linux",
+    AgentSandboxMacFileSystem = "chat.agent.sandbox.fileSystem.mac",
+    AgentSandboxWindowsFileSystem = "chat.agent.sandbox.fileSystem.windows",
+    AgentSandboxWindowsSchemaVersion = "chat.agent.sandbox.advanced.windows.schemaVersion",
+    AgentSandboxAdvancedRuntime = "chat.agent.sandbox.advanced.runtime",
+    DeprecatedAgentSandboxEnabled = "chat.agent.sandbox",
+    DeprecatedAgentSandboxLinuxFileSystem = "chat.agent.sandboxFileSystem.linux",
+    DeprecatedAgentSandboxMacFileSystem = "chat.agent.sandboxFileSystem.mac"
 }
 export declare enum AgentSandboxEnabledValue {
     Off = "off",

package/vscode/src/vs/platform/sandbox/common/settings.js

@@ -3,10 +3,19 @@
 var AgentSandboxSettingId;
 (function (AgentSandboxSettingId) {
     AgentSandboxSettingId["AgentSandboxEnabled"] = "chat.agent.sandbox.enabled";
+    AgentSandboxSettingId["AgentSandboxWindowsEnabled"] = "chat.agent.sandbox.enabledWindows";
     AgentSandboxSettingId["AgentSandboxAllowUnsandboxedCommands"] = "chat.agent.sandbox.allowUnsandboxedCommands";
+    AgentSandboxSettingId["AgentSandboxRetryWithAllowNetworkRequests"] = "chat.agent.sandbox.retryWithAllowNetworkRequests";
     AgentSandboxSettingId["AgentSandboxAutoApproveUnsandboxedCommands"] = "chat.agent.sandbox.autoApproveUnsandboxedCommands";
     AgentSandboxSettingId["AgentSandboxAllowAutoApprove"] = "chat.agent.sandbox.allowAutoApprove";
+    AgentSandboxSettingId["AgentSandboxLinuxFileSystem"] = "chat.agent.sandbox.fileSystem.linux";
+    AgentSandboxSettingId["AgentSandboxMacFileSystem"] = "chat.agent.sandbox.fileSystem.mac";
+    AgentSandboxSettingId["AgentSandboxWindowsFileSystem"] = "chat.agent.sandbox.fileSystem.windows";
+    AgentSandboxSettingId["AgentSandboxWindowsSchemaVersion"] = "chat.agent.sandbox.advanced.windows.schemaVersion";
+    AgentSandboxSettingId["AgentSandboxAdvancedRuntime"] = "chat.agent.sandbox.advanced.runtime";
     AgentSandboxSettingId["DeprecatedAgentSandboxEnabled"] = "chat.agent.sandbox";
+    AgentSandboxSettingId["DeprecatedAgentSandboxLinuxFileSystem"] = "chat.agent.sandboxFileSystem.linux";
+    AgentSandboxSettingId["DeprecatedAgentSandboxMacFileSystem"] = "chat.agent.sandboxFileSystem.mac";
 })(AgentSandboxSettingId || (AgentSandboxSettingId = {}));
 var AgentSandboxEnabledValue;
 (function (AgentSandboxEnabledValue) {

package/vscode/src/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service.d.ts

@@ -0,0 +1,13 @@
+import { URI } from "../../../base/common/uri.js";
+import { IWindowsMxcConfig } from "./sandboxHelperService.js";
+import { IWindowsMxcConfigOptions, IWindowsMxcBuildSandboxPayload } from "@codingame/monaco-vscode-terminal-service-override/vscode/vs/platform/sandbox/common/terminalSandboxMxcRuntime";
+export declare const IWindowsMxcTerminalSandboxRuntime: import("../../instantiation/common/instantiation.js").ServiceIdentifier<IWindowsMxcTerminalSandboxRuntime>;
+export interface IWindowsMxcTerminalSandboxRuntime {
+    readonly _serviceBrand: undefined;
+    getExecutablePath(appRoot: string, arch: string | undefined): string;
+    getRuntimeReadPaths(appRoot: string | undefined, executablePath: string | undefined): string[];
+    createConfig(options: IWindowsMxcConfigOptions, buildSandboxPayload: IWindowsMxcBuildSandboxPayload): Promise<IWindowsMxcConfig>;
+    wrapCommand(executablePath: string, configPath: string): string;
+    wrapUnsandboxedCommand(command: string): string;
+    toWindowsPath(uri: URI): string;
+}

package/vscode/src/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service.js

@@ -0,0 +1,6 @@
+
+import { createDecorator } from '../../instantiation/common/instantiation.js';
+
+const IWindowsMxcTerminalSandboxRuntime = ( createDecorator("windowsMxcTerminalSandboxRuntime"));
+
+export { IWindowsMxcTerminalSandboxRuntime };

package/vscode/src/vs/platform/sandbox/common/terminalSandboxService.service.d.ts

@@ -1,21 +1,22 @@
 import { CancellationToken } from "../../../base/common/cancellation.js";
 import { OperatingSystem } from "../../../base/common/platform.js";
 import { URI } from "../../../base/common/uri.js";
-import { ITerminalSandboxPrerequisiteCheckResult, ITerminalSandboxCommand, ITerminalSandboxWrapResult, ITerminalSandboxResolvedNetworkDomains, ISandboxDependencyInstallOptions, ISandboxDependencyInstallResult } from "@codingame/monaco-vscode-katex-common/vscode/vs/platform/sandbox/common/terminalSandboxService";
+import { ITerminalSandboxPrecheckInputs, ITerminalSandboxPrerequisiteCheckResult, ITerminalSandboxCommand, ITerminalSandboxWrapResult, ITerminalSandboxResolvedNetworkDomains, ISandboxDependencyInstallOptions, ISandboxDependencyInstallResult } from "@codingame/monaco-vscode-chat-service-override/vscode/vs/platform/sandbox/common/terminalSandboxService";
 export declare const ITerminalSandboxService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<ITerminalSandboxService>;
 export interface ITerminalSandboxService {
     readonly _serviceBrand: undefined;
-    isEnabled(): Promise<boolean>;
-    isSandboxAllowNetworkEnabled(): Promise<boolean>;
+    isEnabled(precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<boolean>;
+    isSandboxAllowNetworkEnabled(precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<boolean>;
     getOS(): Promise<OperatingSystem>;
-    checkForSandboxingPrereqs(forceRefresh?: boolean): Promise<ITerminalSandboxPrerequisiteCheckResult>;
+    checkForSandboxingPrereqs(forceRefresh?: boolean, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<ITerminalSandboxPrerequisiteCheckResult>;
     /**
     * Wraps a command line for sandbox execution. Command details are optional,
     * but when provided they are used to derive command-specific read/write
-    * allow-list entries.
+    * allow-list entries. When explicitly requested, `requestAllowNetwork`
+    * retains sandbox execution while using a network-unrestricted config.
     */
-    wrapCommand(command: string, requestUnsandboxedExecution?: boolean, shell?: string, cwd?: URI, commandDetails?: readonly ITerminalSandboxCommand[]): Promise<ITerminalSandboxWrapResult>;
-    getSandboxConfigPath(forceRefresh?: boolean): Promise<string | undefined>;
+    wrapCommand(command: string, requestUnsandboxedExecution?: boolean, shell?: string, cwd?: URI, commandDetails?: readonly ITerminalSandboxCommand[], requestAllowNetwork?: boolean): Promise<ITerminalSandboxWrapResult>;
+    getSandboxConfigPath(forceRefresh?: boolean, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<string | undefined>;
     getTempDir(): URI | undefined;
     setNeedsForceUpdateConfigFile(): void;
     getResolvedNetworkDomains(): ITerminalSandboxResolvedNetworkDomains;

package/vscode/src/vs/platform/telemetry/common/telemetry.service.d.ts

@@ -33,7 +33,7 @@ export interface ITelemetryService {
     * Sets a common property that will be attached to all telemetry events.
     * Common properties are added after PII cleaning and cannot be overridden by event data.
     */
-    setCommonProperty(name: string, value: string): void;
+    setCommonProperty(name: string, value: string | boolean): void;
 }
 export declare const ICustomEndpointTelemetryService: import("../../instantiation/common/instantiation.js").ServiceIdentifier<ICustomEndpointTelemetryService>;
 export interface ICustomEndpointTelemetryService {

package/vscode/src/vs/platform/telemetry/common/telemetryUtils.js

@@ -37,7 +37,7 @@ class NullEndpointTelemetryService {
 const telemetryLogId = "telemetry";
 const TelemetryLogGroup = {
     id: telemetryLogId,
-    name: ( localize(2165, "Telemetry"))
+    name: ( localize(2195, "Telemetry"))
 };
 function supportsTelemetry(productService, environmentService) {
     if (!environmentService.isBuilt && !environmentService.disableTelemetry) {
@@ -195,44 +195,65 @@ function anonymizeFilePaths(stack, cleanupPatterns) {
     }
     return updatedStack;
 }
+const userDataRegexes = [{
+    label: "URL",
+    regex: /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s]*/
+}, {
+    label: "Google API Key",
+    regex: /AIza[A-Za-z0-9_\\\-]{35}/
+}, {
+    label: "JWT",
+    regex: /eyJ[0eXAiOiJKV1Qi|hbGci|a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+/
+}, {
+    label: "Slack Token",
+    regex: /xox[pbar]\-[A-Za-z0-9]/
+}, {
+    label: "GitHub Token",
+    regex: /(gh[psuro]_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})/
+}, {
+    label: "Generic Secret",
+    regex: /(key|token|sig|secret|signature|password|passwd|pwd|android:value)[^a-zA-Z0-9]/i
+}, {
+    label: "CLI Credentials",
+    regex: /((login|psexec|(certutil|psexec)\.exe).{1,50}(\s-u(ser(name)?)?\s+.{3,100})?\s-(admin|user|vm|root)?p(ass(word)?)?\s+["']?[^$\-\/\s]|(^|[\s\r\n\\])net(\.exe)?.{1,5}(user\s+|share\s+\/user:| user -? secrets ? set) \s + [^ $\s \/])/
+}, {
+    label: "Microsoft Entra ID",
+    regex: /eyJ(?:0eXAiOiJKV1Qi|hbGci|[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.)/
+}, {
+    label: "Email",
+    regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
+}];
+function redactIfPossibleUserInfo(value, probe = value) {
+    for (const secretRegex of userDataRegexes) {
+        if (secretRegex.regex.test(probe)) {
+            return `<REDACTED: ${secretRegex.label}>`;
+        }
+    }
+    return value;
+}
 function removePropertiesWithPossibleUserInfo(property) {
     if (!property) {
         return property;
     }
-    const userDataRegexes = [{
-        label: "URL",
-        regex: /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s]*/
-    }, {
-        label: "Google API Key",
-        regex: /AIza[A-Za-z0-9_\\\-]{35}/
-    }, {
-        label: "JWT",
-        regex: /eyJ[0eXAiOiJKV1Qi|hbGci|a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+/
-    }, {
-        label: "Slack Token",
-        regex: /xox[pbar]\-[A-Za-z0-9]/
-    }, {
-        label: "GitHub Token",
-        regex: /(gh[psuro]_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})/
-    }, {
-        label: "Generic Secret",
-        regex: /(key|token|sig|secret|signature|password|passwd|pwd|android:value)[^a-zA-Z0-9]/i
-    }, {
-        label: "CLI Credentials",
-        regex: /((login|psexec|(certutil|psexec)\.exe).{1,50}(\s-u(ser(name)?)?\s+.{3,100})?\s-(admin|user|vm|root)?p(ass(word)?)?\s+["']?[^$\-\/\s]|(^|[\s\r\n\\])net(\.exe)?.{1,5}(user\s+|share\s+\/user:| user -? secrets ? set) \s + [^ $\s \/])/
-    }, {
-        label: "Microsoft Entra ID",
-        regex: /eyJ(?:0eXAiOiJKV1Qi|hbGci|[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.)/
-    }, {
-        label: "Email",
-        regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
-    }];
+    let hasMatch = false;
     for (const secretRegex of userDataRegexes) {
         if (secretRegex.regex.test(property)) {
-            return `<REDACTED: ${secretRegex.label}>`;
+            hasMatch = true;
+            break;
         }
     }
-    return property;
+    if (!hasMatch) {
+        return property;
+    }
+    if (!property.includes("\n")) {
+        return redactIfPossibleUserInfo(property);
+    }
+    const lines = property.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const probe = i < lines.length - 1 ? lines[i] + "\n" : lines[i];
+        lines[i] = redactIfPossibleUserInfo(lines[i], probe);
+    }
+    return lines.join("\n");
 }
 function cleanData(data, cleanUpPatterns) {
     if (!data) {

package/vscode/src/vs/platform/terminal/common/capabilities/capabilities.d.ts

@@ -117,8 +117,14 @@ export interface ICwdDetectionCapability {
     readonly type: TerminalCapability.CwdDetection;
     readonly onDidChangeCwd: Event<string>;
     readonly cwds: string[];
+    /**
+     * Whether the current cwd came from a trusted source. This is `true` only when the cwd was
+     * reported by the VS Code shell integration with a valid nonce. OSC 7, OSC 9;9 and OSC 1337
+     * cwd updates are always considered untrusted because their protocols have no nonce.
+     */
+    readonly isTrusted: boolean;
     getCwd(): string;
-    updateCwd(cwd: string): void;
+    updateCwd(cwd: string, isTrusted?: boolean): void;
 }
 export interface IShellEnvDetectionCapability {
     readonly type: TerminalCapability.ShellEnvDetection;

package/vscode/src/vs/platform/terminal/common/capabilities/cwdDetectionCapability.d.ts

@@ -3,13 +3,15 @@ import { ICwdDetectionCapability, TerminalCapability } from "./capabilities.js";
 export declare class CwdDetectionCapability extends Disposable implements ICwdDetectionCapability {
     readonly type = TerminalCapability.CwdDetection;
     private _cwd;
+    private _isTrusted;
     private _cwds;
     /**
      * Gets the list of cwds seen in this session in order of last accessed.
      */
     get cwds(): string[];
+    get isTrusted(): boolean;
     private readonly _onDidChangeCwd;
     readonly onDidChangeCwd: import("../../../../base/common/event.js").Event<string>;
     getCwd(): string;
-    updateCwd(cwd: string): void;
+    updateCwd(cwd: string, isTrusted?: boolean): void;
 }

package/vscode/src/vs/platform/terminal/common/capabilities/cwdDetectionCapability.js

@@ -8,6 +8,7 @@ class CwdDetectionCapability extends Disposable {
         super(...arguments);
         this.type = TerminalCapability.CwdDetection;
         this._cwd = "";
+        this._isTrusted = true;
         this._cwds = ( new Map());
         this._onDidChangeCwd = this._register(( new Emitter()));
         this.onDidChangeCwd = this._onDidChangeCwd.event;
@@ -15,12 +16,16 @@ class CwdDetectionCapability extends Disposable {
     get cwds() {
         return Array.from(( this._cwds.keys()));
     }
+    get isTrusted() {
+        return this._isTrusted;
+    }
     getCwd() {
         return this._cwd;
     }
-    updateCwd(cwd) {
-        const didChange = this._cwd !== cwd;
+    updateCwd(cwd, isTrusted = true) {
+        const didChange = this._cwd !== cwd || this._isTrusted !== isTrusted;
         this._cwd = cwd;
+        this._isTrusted = isTrusted;
         const count = this._cwds.get(this._cwd) || 0;
         this._cwds.delete(this._cwd);
         this._cwds.set(this._cwd, count + 1);