@codingame/monaco-vscode-chat-service-override 33.0.9 → 34.0.0

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineAnalyzer.d.ts

@@ -0,0 +1,54 @@
+import type { IMarkdownString } from "@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent";
+import type { IDisposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import type { OperatingSystem } from "@codingame/monaco-vscode-api/vscode/vs/base/common/platform";
+import type { URI } from "@codingame/monaco-vscode-api/vscode/vs/base/common/uri";
+import type { ConfigurationTarget } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration";
+import type { ToolConfirmationAction } from "@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/tools/languageModelToolsService";
+import type { INpmScriptAutoApproveResult } from "./autoApprove/npmScriptAutoApprover.js";
+import type { TreeSitterCommandParserLanguage } from "../../treeSitterCommandParser.js";
+export interface IAutoApproveRule {
+    regex: RegExp;
+    regexCaseInsensitive: RegExp;
+    sourceText: string;
+    sourceTarget: ConfigurationTarget | "session";
+    isDefaultRule: boolean;
+}
+export interface INpmScriptAutoApproveRule {
+    type: "npmScript";
+    npmScriptResult: INpmScriptAutoApproveResult;
+}
+export declare function isAutoApproveRule(rule: IAutoApproveRule | INpmScriptAutoApproveRule | undefined): rule is IAutoApproveRule;
+export declare function isNpmScriptAutoApproveRule(rule: IAutoApproveRule | INpmScriptAutoApproveRule | undefined): rule is INpmScriptAutoApproveRule;
+export interface ICommandLineAnalyzer extends IDisposable {
+    analyze(options: ICommandLineAnalyzerOptions): Promise<ICommandLineAnalyzerResult>;
+}
+export interface ICommandLineAnalyzerOptions {
+    commandLine: string;
+    cwd: URI | undefined;
+    shell: string;
+    os: OperatingSystem;
+    treeSitterLanguage: TreeSitterCommandParserLanguage;
+    terminalToolSessionId: string;
+    chatSessionResource: URI | undefined;
+    requiresUnsandboxConfirmation?: boolean;
+    requiresAllowNetworkConfirmation?: boolean;
+    hasSessionAutoApproval?: boolean;
+}
+export interface ICommandLineAnalyzerResult {
+    /**
+     * Whether auto approval is allowed based on the analysis, when false this
+     * will block auto approval.
+    */
+    readonly isAutoApproveAllowed: boolean;
+    /**
+     * Whether the command line was explicitly auto approved by this analyzer.
+     * - `true`: This analyzer explicitly approves auto-execution
+     * - `false`: This analyzer explicitly denies auto-execution
+     * - `undefined`: This analyzer does not make an approval/denial decision
+     */
+    readonly isAutoApproved?: boolean;
+    readonly disclaimers?: readonly (string | IMarkdownString)[];
+    readonly autoApproveInfo?: IMarkdownString;
+    readonly customActions?: ToolConfirmationAction[];
+    readonly forceAutoApproval?: boolean;
+}

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineAnalyzer.js

@@ -0,0 +1,10 @@
+
+
+function isAutoApproveRule(rule) {
+    return !!rule && 'sourceText' in rule;
+}
+function isNpmScriptAutoApproveRule(rule) {
+    return !!rule && 'type' in rule && rule.type === 'npmScript';
+}
+
+export { isAutoApproveRule, isNpmScriptAutoApproveRule };

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineAutoApproveAnalyzer.d.ts

@@ -0,0 +1,20 @@
+import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
+import { IInstantiationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation";
+import { ITerminalChatService } from "@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminal/browser/terminal.service";
+import { IStorageService } from "@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage.service";
+import type { RunInTerminalToolTelemetry } from "../../runInTerminalToolTelemetry.js";
+import { type TreeSitterCommandParser } from "../../treeSitterCommandParser.js";
+import { type ICommandLineAnalyzer, type ICommandLineAnalyzerOptions, type ICommandLineAnalyzerResult } from "./commandLineAnalyzer.js";
+export declare class CommandLineAutoApproveAnalyzer extends Disposable implements ICommandLineAnalyzer {
+    private readonly _treeSitterCommandParser;
+    private readonly _telemetry;
+    private readonly _log;
+    private readonly _configurationService;
+    private readonly _storageService;
+    private readonly _terminalChatService;
+    private readonly _commandLineAutoApprover;
+    constructor(_treeSitterCommandParser: TreeSitterCommandParser, _telemetry: RunInTerminalToolTelemetry, _log: (message: string, ...args: unknown[]) => void, _configurationService: IConfigurationService, instantiationService: IInstantiationService, _storageService: IStorageService, _terminalChatService: ITerminalChatService);
+    analyze(options: ICommandLineAnalyzerOptions): Promise<ICommandLineAnalyzerResult>;
+    private _createAutoApproveInfo;
+}

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineAutoApproveAnalyzer.js

@@ -0,0 +1,310 @@
+
+import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
+import { asArray } from '@codingame/monaco-vscode-api/vscode/vs/base/common/arrays';
+import { createCommandUri, MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
+import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
+import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
+import { ConfigurationTarget } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration';
+import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
+import { IInstantiationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
+import { ITerminalChatService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminal/browser/terminal.service';
+import { StorageScope } from '@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage';
+import { IStorageService } from '@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage.service';
+import { TerminalToolConfirmationStorageKeys } from '@codingame/monaco-vscode-katex-common/vscode/vs/workbench/contrib/chat/browser/widget/chatContentParts/toolInvocationParts/chatTerminalToolConfirmationSubPart';
+import { ChatConfiguration } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/constants';
+import { TerminalChatAgentToolsSettingId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration';
+import { isPowerShell, generateAutoApproveActions, dedupeRules } from '../../runInTerminalHelpers.js';
+import { isAutoApproveRule, isNpmScriptAutoApproveRule } from './commandLineAnalyzer.js';
+import { TerminalChatCommandId } from '@codingame/monaco-vscode-xterm-common/vscode/vs/workbench/contrib/terminalContrib/chat/browser/terminalChat';
+import { CommandLineAutoApprover } from './autoApprove/commandLineAutoApprover.js';
+
+const promptInjectionWarningCommandsLower = ["curl", "wget"];
+const promptInjectionWarningCommandsLowerPwshOnly = ["invoke-restmethod", "invoke-webrequest", "irm", "iwr"];
+let CommandLineAutoApproveAnalyzer = class CommandLineAutoApproveAnalyzer extends Disposable {
+    constructor(
+        _treeSitterCommandParser,
+        _telemetry,
+        _log,
+        _configurationService,
+        instantiationService,
+        _storageService,
+        _terminalChatService
+    ) {
+        super();
+        this._treeSitterCommandParser = _treeSitterCommandParser;
+        this._telemetry = _telemetry;
+        this._log = _log;
+        this._configurationService = _configurationService;
+        this._storageService = _storageService;
+        this._terminalChatService = _terminalChatService;
+        this._commandLineAutoApprover = this._register(instantiationService.createInstance(CommandLineAutoApprover));
+    }
+    async analyze(options) {
+        const isAutoApproveEnabledInSettings = this._configurationService.getValue(TerminalChatAgentToolsSettingId.EnableAutoApprove) === true;
+        if (isAutoApproveEnabledInSettings && options.chatSessionResource && this._terminalChatService.hasChatSessionAutoApproval(options.chatSessionResource)) {
+            this._log("Session has auto approval enabled, auto approving command");
+            const disableUri = createCommandUri(
+                TerminalChatCommandId.DisableSessionAutoApproval,
+                options.chatSessionResource
+            );
+            const mdTrustSettings = {
+                isTrusted: {
+                    enabledCommands: [TerminalChatCommandId.DisableSessionAutoApproval]
+                }
+            };
+            return {
+                isAutoApproved: true,
+                isAutoApproveAllowed: true,
+                disclaimers: [],
+                autoApproveInfo: ( new MarkdownString(`${( localize(14639, "Auto approved for this session"))} ([${( localize(14640, "Disable"))}](${( disableUri.toString())}))`, mdTrustSettings))
+            };
+        }
+        const trimmedCommandLine = options.commandLine.trimStart();
+        let subCommands;
+        try {
+            subCommands = await this._treeSitterCommandParser.extractSubCommands(options.treeSitterLanguage, trimmedCommandLine);
+            this._log(
+                `Parsed sub-commands via ${options.treeSitterLanguage} grammar`,
+                subCommands
+            );
+        } catch (e) {
+            console.error(e);
+            this._log(`Failed to parse sub-commands via ${options.treeSitterLanguage} grammar`);
+        }
+        let isAutoApproved = false;
+        let autoApproveInfo;
+        let customActions;
+        if (!subCommands?.length) {
+            if (trimmedCommandLine.length === 0) {
+                this._log("Command line is empty, auto approving");
+                return {
+                    isAutoApproved: true,
+                    isAutoApproveAllowed: true,
+                    disclaimers: []
+                };
+            }
+            this._log("No sub-commands were parsed, auto approval is not allowed");
+            return {
+                isAutoApproveAllowed: false,
+                disclaimers: []
+            };
+        }
+        const subCommandResults = await Promise.all(( subCommands.map(
+            e => this._commandLineAutoApprover.isCommandAutoApproved(e, options.shell, options.os, options.cwd, options.chatSessionResource)
+        )));
+        const commandLineResult = this._commandLineAutoApprover.isCommandLineAutoApproved(trimmedCommandLine, options.chatSessionResource);
+        const autoApproveReasons = [...( subCommandResults.map(e => e.reason)), commandLineResult.reason];
+        let isDenied = false;
+        let autoApproveReason;
+        let autoApproveDefault;
+        const deniedSubCommandResult = subCommandResults.find(e => e.result === "denied");
+        if (deniedSubCommandResult) {
+            this._log("Sub-command DENIED auto approval");
+            isDenied = true;
+            autoApproveDefault = isAutoApproveRule(deniedSubCommandResult.rule) ? deniedSubCommandResult.rule.isDefaultRule : undefined;
+            autoApproveReason = "subCommand";
+        } else if (commandLineResult.result === "denied") {
+            this._log("Command line DENIED auto approval");
+            isDenied = true;
+            autoApproveDefault = isAutoApproveRule(commandLineResult.rule) ? commandLineResult.rule.isDefaultRule : undefined;
+            autoApproveReason = "commandLine";
+        } else {
+            if (subCommandResults.every(e => e.result === "approved")) {
+                this._log("All sub-commands auto-approved");
+                isAutoApproved = true;
+                autoApproveReason = "subCommand";
+                autoApproveDefault = subCommandResults.every(e => isAutoApproveRule(e.rule) && e.rule.isDefaultRule);
+            } else {
+                this._log("All sub-commands NOT auto-approved");
+                if (commandLineResult.result === "approved") {
+                    this._log("Command line auto-approved");
+                    autoApproveReason = "commandLine";
+                    isAutoApproved = true;
+                    autoApproveDefault = isAutoApproveRule(commandLineResult.rule) ? commandLineResult.rule.isDefaultRule : undefined;
+                } else {
+                    this._log("Command line NOT auto-approved");
+                }
+            }
+        }
+        for (const reason of autoApproveReasons) {
+            this._log(`- ${reason}`);
+        }
+        const isAutoApproveEnabled = this._configurationService.getValue(TerminalChatAgentToolsSettingId.EnableAutoApprove) === true;
+        const isAutoApproveWarningAccepted = this._storageService.getBoolean(
+            TerminalToolConfirmationStorageKeys.TerminalAutoApproveWarningAccepted,
+            StorageScope.APPLICATION,
+            false
+        );
+        if (isAutoApproveEnabled && isAutoApproved) {
+            autoApproveInfo = this._createAutoApproveInfo(
+                isAutoApproved,
+                isDenied,
+                autoApproveReason,
+                subCommandResults,
+                commandLineResult
+            );
+        } else {
+            isAutoApproved = false;
+        }
+        this._telemetry.logPrepare({
+            terminalToolSessionId: options.terminalToolSessionId,
+            subCommands,
+            autoApproveAllowed: !isAutoApproveEnabled ? "off" : isAutoApproveWarningAccepted ? "allowed" : "needsOptIn",
+            autoApproveResult: isAutoApproved ? "approved" : isDenied ? "denied" : "manual",
+            autoApproveReason,
+            autoApproveDefault
+        });
+        const disclaimers = [];
+        const subCommandsLowerFirstWordOnly = ( subCommands.map(command => command.split(" ")[0].toLowerCase()));
+        if (!isAutoApproved && (( subCommandsLowerFirstWordOnly.some(command => promptInjectionWarningCommandsLower.includes(command))) || (isPowerShell(options.shell, options.os) && ( subCommandsLowerFirstWordOnly.some(command => promptInjectionWarningCommandsLowerPwshOnly.includes(command)))))) {
+            disclaimers.push(( localize(
+                14641,
+                "Web content may contain malicious code or attempt prompt injection attacks."
+            )));
+        }
+        if (isAutoApproveEnabled && isDenied) {
+            const denialInfo = this._createAutoApproveInfo(
+                isAutoApproved,
+                isDenied,
+                autoApproveReason,
+                subCommandResults,
+                commandLineResult
+            );
+            if (denialInfo) {
+                disclaimers.push(denialInfo);
+            }
+        }
+        if (!isAutoApproved && isAutoApproveEnabled) {
+            customActions = generateAutoApproveActions(trimmedCommandLine, subCommands, {
+                subCommandResults,
+                commandLineResult
+            });
+        }
+        return {
+            isAutoApproved,
+            isAutoApproveAllowed: true,
+            disclaimers,
+            autoApproveInfo,
+            customActions
+        };
+    }
+    _createAutoApproveInfo(
+        isAutoApproved,
+        isDenied,
+        autoApproveReason,
+        subCommandResults,
+        commandLineResult
+    ) {
+        const formatRuleLinks = result => {
+            return ( asArray(result).filter(e => isAutoApproveRule(e.rule)).map(e => {
+                const escapedSourceText = e.rule.sourceText.replaceAll("$", "\\$");
+                if (e.rule.sourceTarget === "session") {
+                    return localize(14642, "{0} (session)", `\`${escapedSourceText}\``);
+                }
+                const settingsUri = createCommandUri(TerminalChatCommandId.OpenTerminalSettingsLink, e.rule.sourceTarget);
+                const tooltip = ( localize(14643, "View rule in settings"));
+                let label = escapedSourceText;
+                switch (e.rule?.sourceTarget) {
+                case ConfigurationTarget.DEFAULT:
+                    label = `${label} (default)`;
+                    break;
+                case ConfigurationTarget.USER:
+                case ConfigurationTarget.USER_LOCAL:
+                    label = `${label} (user)`;
+                    break;
+                case ConfigurationTarget.USER_REMOTE:
+                    label = `${label} (remote)`;
+                    break;
+                case ConfigurationTarget.WORKSPACE:
+                case ConfigurationTarget.WORKSPACE_FOLDER:
+                    label = `${label} (workspace)`;
+                    break;
+                }
+                return `[\`${label}\`](${( settingsUri.toString())} "${tooltip}")`;
+            })).join(", ");
+        };
+        const mdTrustSettings = {
+            isTrusted: {
+                enabledCommands: [TerminalChatCommandId.OpenTerminalSettingsLink]
+            }
+        };
+        const config = this._configurationService.inspect(ChatConfiguration.GlobalAutoApprove);
+        const isGlobalAutoApproved = config?.value ?? config.defaultValue;
+        if (isGlobalAutoApproved) {
+            const settingsUri = createCommandUri(TerminalChatCommandId.OpenTerminalSettingsLink, "global");
+            return (new MarkdownString(`${( localize(
+                14644,
+                "Auto approved by setting {0}",
+                `[\`${ChatConfiguration.GlobalAutoApprove}\`](${( settingsUri.toString())} "${( localize(14645, "View settings"))}")`
+            ))}`, mdTrustSettings));
+        }
+        if (isAutoApproved) {
+            switch (autoApproveReason) {
+            case "commandLine":
+                {
+                    if (isAutoApproveRule(commandLineResult.rule)) {
+                        return (new MarkdownString(
+                            localize(14646, "Auto approved by rule {0}", formatRuleLinks(commandLineResult)),
+                            mdTrustSettings
+                        ));
+                    }
+                    break;
+                }
+            case "subCommand":
+                {
+                    const npmScriptApproval = subCommandResults.find(e => isNpmScriptAutoApproveRule(e.rule));
+                    if (npmScriptApproval && isNpmScriptAutoApproveRule(npmScriptApproval.rule) && npmScriptApproval.rule.npmScriptResult.autoApproveInfo) {
+                        return npmScriptApproval.rule.npmScriptResult.autoApproveInfo;
+                    }
+                    const uniqueRules = dedupeRules(subCommandResults);
+                    if (uniqueRules.length === 1) {
+                        return (new MarkdownString(
+                            localize(14646, "Auto approved by rule {0}", formatRuleLinks(uniqueRules)),
+                            mdTrustSettings
+                        ));
+                    } else if (uniqueRules.length > 1) {
+                        return (new MarkdownString(
+                            localize(14647, "Auto approved by rules {0}", formatRuleLinks(uniqueRules)),
+                            mdTrustSettings
+                        ));
+                    }
+                    break;
+                }
+            }
+        } else if (isDenied) {
+            switch (autoApproveReason) {
+            case "commandLine":
+                {
+                    if (commandLineResult.rule) {
+                        return (new MarkdownString(localize(
+                            14648,
+                            "Auto approval denied by rule {0}",
+                            formatRuleLinks(commandLineResult)
+                        ), mdTrustSettings));
+                    }
+                    break;
+                }
+            case "subCommand":
+                {
+                    const uniqueRules = dedupeRules(subCommandResults.filter(e => e.result === "denied"));
+                    if (uniqueRules.length === 1) {
+                        return (new MarkdownString(
+                            localize(14648, "Auto approval denied by rule {0}", formatRuleLinks(uniqueRules)),
+                            mdTrustSettings
+                        ));
+                    } else if (uniqueRules.length > 1) {
+                        return (new MarkdownString(
+                            localize(14649, "Auto approval denied by rules {0}", formatRuleLinks(uniqueRules)),
+                            mdTrustSettings
+                        ));
+                    }
+                    break;
+                }
+            }
+        }
+        return undefined;
+    }
+};
+CommandLineAutoApproveAnalyzer = ( __decorate([( __param(3, IConfigurationService)), ( __param(4, IInstantiationService)), ( __param(5, IStorageService)), ( __param(6, ITerminalChatService))], CommandLineAutoApproveAnalyzer));
+
+export { CommandLineAutoApproveAnalyzer };

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineFileWriteAnalyzer.d.ts

@@ -0,0 +1,27 @@
+import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
+import { IWorkspaceContextService } from "@codingame/monaco-vscode-api/vscode/vs/platform/workspace/common/workspace.service";
+import { type TreeSitterCommandParser } from "../../treeSitterCommandParser.js";
+import type { ICommandLineAnalyzer, ICommandLineAnalyzerOptions, ICommandLineAnalyzerResult } from "./commandLineAnalyzer.js";
+import { ILabelService } from "@codingame/monaco-vscode-api/vscode/vs/platform/label/common/label.service";
+export declare class CommandLineFileWriteAnalyzer extends Disposable implements ICommandLineAnalyzer {
+    private readonly _treeSitterCommandParser;
+    private readonly _log;
+    private readonly _configurationService;
+    private readonly _labelService;
+    private readonly _workspaceContextService;
+    constructor(_treeSitterCommandParser: TreeSitterCommandParser, _log: (message: string, ...args: unknown[]) => void, _configurationService: IConfigurationService, _labelService: ILabelService, _workspaceContextService: IWorkspaceContextService);
+    analyze(options: ICommandLineAnalyzerOptions): Promise<ICommandLineAnalyzerResult>;
+    private _getFileWrites;
+    private _stripSurroundingQuotes;
+    private _mapNullDevice;
+    private _getResult;
+    /**
+     * Returns true if the given URI path points inside an OS temporary directory.
+     * On posix systems this matches `/tmp/`. On Windows this matches any `temp`
+     * or `tmp` directory segment (case-insensitive), which covers the canonical
+     * user temp (`...\AppData\Local\Temp\`), system temp (`C:\Windows\Temp\`),
+     * and common dev conventions like `C:\Temp\` and `C:\tmp\`.
+     */
+    private _isInTempDirectory;
+}

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineFileWriteAnalyzer.js

@@ -0,0 +1,177 @@
+
+import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
+import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
+import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
+import { win32, posix } from '@codingame/monaco-vscode-api/vscode/vs/base/common/path';
+import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
+import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
+import { IWorkspaceContextService } from '@codingame/monaco-vscode-api/vscode/vs/platform/workspace/common/workspace.service';
+import { TerminalChatAgentToolsSettingId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration';
+import { TreeSitterCommandParserLanguage } from '../../treeSitterCommandParser.js';
+import { OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
+import { isString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
+import { ILabelService } from '@codingame/monaco-vscode-api/vscode/vs/platform/label/common/label.service';
+
+const nullDevice = Symbol("null device");
+let CommandLineFileWriteAnalyzer = class CommandLineFileWriteAnalyzer extends Disposable {
+    constructor(
+        _treeSitterCommandParser,
+        _log,
+        _configurationService,
+        _labelService,
+        _workspaceContextService
+    ) {
+        super();
+        this._treeSitterCommandParser = _treeSitterCommandParser;
+        this._log = _log;
+        this._configurationService = _configurationService;
+        this._labelService = _labelService;
+        this._workspaceContextService = _workspaceContextService;
+    }
+    async analyze(options) {
+        let fileWrites;
+        try {
+            fileWrites = await this._getFileWrites(options);
+        } catch (e) {
+            console.error(e);
+            this._log("Failed to get file writes via grammar", options.treeSitterLanguage);
+            return {
+                isAutoApproveAllowed: false
+            };
+        }
+        return this._getResult(options, fileWrites);
+    }
+    async _getFileWrites(options) {
+        let fileWrites = [];
+        const capturedFileWrites = ( (await this._treeSitterCommandParser.getFileWrites(options.treeSitterLanguage, options.commandLine)).map(this._mapNullDevice.bind(this, options)));
+        const commandFileWrites = ( (await this._treeSitterCommandParser.getCommandFileWrites(options.treeSitterLanguage, options.commandLine)).map(this._mapNullDevice.bind(this, options)));
+        const allCapturedFileWrites = [...capturedFileWrites, ...commandFileWrites];
+        if (allCapturedFileWrites.length) {
+            const cwd = options.cwd;
+            if (cwd) {
+                this._log("Detected cwd", ( cwd.toString()));
+                fileWrites = ( allCapturedFileWrites.map(e => {
+                    if (e === nullDevice) {
+                        return e;
+                    }
+                    if (/^['"].*['"]$/.test(e)) {
+                        e = this._stripSurroundingQuotes(e);
+                    }
+                    const isAbsolute = options.os === OperatingSystem.Windows ? win32.isAbsolute(e) : posix.isAbsolute(e);
+                    if (isAbsolute) {
+                        return cwd.with({
+                            path: e
+                        });
+                    }
+                    return URI.joinPath(cwd, e);
+                }));
+            } else {
+                this._log("Cwd could not be detected");
+                fileWrites = allCapturedFileWrites;
+            }
+        }
+        this._log("File writes detected", ( fileWrites.map(e => ( e.toString()))));
+        return fileWrites;
+    }
+    _stripSurroundingQuotes(text) {
+        if ((text.startsWith("\"") && text.endsWith("\"")) || (text.startsWith("'") && text.endsWith("'"))) {
+            return text.slice(1, -1);
+        }
+        return text;
+    }
+    _mapNullDevice(options, rawFileWrite) {
+        if (options.treeSitterLanguage === TreeSitterCommandParserLanguage.PowerShell) {
+            return rawFileWrite === "$null" ? nullDevice : rawFileWrite;
+        }
+        return rawFileWrite === "/dev/null" ? nullDevice : rawFileWrite;
+    }
+    _getResult(options, fileWrites) {
+        let isAutoApproveAllowed = true;
+        if (fileWrites.length > 0) {
+            const blockDetectedFileWrites = this._configurationService.getValue(TerminalChatAgentToolsSettingId.BlockDetectedFileWrites);
+            switch (blockDetectedFileWrites) {
+            case "all":
+                {
+                    isAutoApproveAllowed = false;
+                    this._log("File writes blocked due to \"all\" setting");
+                    break;
+                }
+            case "outsideWorkspace":
+                {
+                    const workspaceFolders = this._workspaceContextService.getWorkspace().folders;
+                    if (workspaceFolders.length > 0) {
+                        for (const fileWrite of fileWrites) {
+                            if (fileWrite === nullDevice) {
+                                this._log("File write to null device allowed", URI.isUri(fileWrite) ? ( fileWrite.toString()) : fileWrite);
+                                continue;
+                            }
+                            if (isString(fileWrite)) {
+                                const isAbsolute = options.os === OperatingSystem.Windows ? win32.isAbsolute(fileWrite) : posix.isAbsolute(fileWrite);
+                                if (!isAbsolute) {
+                                    isAutoApproveAllowed = false;
+                                    this._log("File write blocked due to unknown terminal cwd", fileWrite);
+                                    break;
+                                }
+                            }
+                            const fileUri = URI.isUri(fileWrite) ? fileWrite : URI.file(fileWrite);
+                            if (fileUri.fsPath.match(/[$\(\){}`~%]/)) {
+                                isAutoApproveAllowed = false;
+                                this._log(
+                                    "File write blocked due to likely containing a variable, sub-command, or tilde expansion",
+                                    ( fileUri.toString())
+                                );
+                                break;
+                            }
+                            const isInsideWorkspace = ( workspaceFolders.some(
+                                folder => folder.uri.scheme === fileUri.scheme && (fileUri.path.startsWith(folder.uri.path + "/") || fileUri.path === folder.uri.path)
+                            ));
+                            if (!isInsideWorkspace) {
+                                if (options.hasSessionAutoApproval && this._isInTempDirectory(fileUri.path, options.os)) {
+                                    continue;
+                                }
+                                isAutoApproveAllowed = false;
+                                this._log("File write blocked outside workspace", ( fileUri.toString()));
+                                break;
+                            }
+                        }
+                    } else {
+                        const hasOnlyNullDevices = fileWrites.every(fw => fw === nullDevice);
+                        if (!hasOnlyNullDevices) {
+                            isAutoApproveAllowed = false;
+                            this._log("File writes blocked - no workspace folders");
+                        }
+                    }
+                    break;
+                }
+            }
+        }
+        const disclaimers = [];
+        if (fileWrites.length > 0) {
+            const fileWritesList = ( fileWrites.map(
+                fw => `\`${URI.isUri(fw) ? this._labelService.getUriLabel(fw) : fw === nullDevice ? "/dev/null" : ( fw.toString())}\``
+            )).join(", ");
+            if (!isAutoApproveAllowed) {
+                disclaimers.push(( localize(
+                    14650,
+                    "File write operations detected that cannot be auto approved: {0}",
+                    fileWritesList
+                )));
+            } else {
+                disclaimers.push(( localize(14651, "File write operations detected: {0}", fileWritesList)));
+            }
+        }
+        return {
+            isAutoApproveAllowed,
+            disclaimers
+        };
+    }
+    _isInTempDirectory(uriPath, os) {
+        if (os === OperatingSystem.Windows) {
+            return /[\\/]te?mp[\\/].+/i.test(uriPath);
+        }
+        return uriPath.startsWith("/tmp/");
+    }
+};
+CommandLineFileWriteAnalyzer = ( __decorate([( __param(2, IConfigurationService)), ( __param(3, ILabelService)), ( __param(4, IWorkspaceContextService))], CommandLineFileWriteAnalyzer));
+
+export { CommandLineFileWriteAnalyzer };

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineSandboxAnalyzer.d.ts

@@ -0,0 +1,11 @@
+import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
+import { ITerminalSandboxService } from "../../../common/terminalSandboxService.js";
+import type { ICommandLineAnalyzer, ICommandLineAnalyzerOptions, ICommandLineAnalyzerResult } from "./commandLineAnalyzer.js";
+export declare class CommandLineSandboxAnalyzer extends Disposable implements ICommandLineAnalyzer {
+    private readonly _sandboxService;
+    private readonly _configurationService;
+    constructor(_sandboxService: ITerminalSandboxService, _configurationService: IConfigurationService);
+    private _isAutoApproveEnabled;
+    analyze(_options: ICommandLineAnalyzerOptions): Promise<ICommandLineAnalyzerResult>;
+}

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineAnalyzer/commandLineSandboxAnalyzer.js

@@ -0,0 +1,33 @@
+
+import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
+import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
+import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
+import { TerminalChatAgentToolsSettingId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration';
+import '../../../common/terminalSandboxService.js';
+import { ITerminalSandboxService } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/terminalSandboxService.service';
+
+let CommandLineSandboxAnalyzer = class CommandLineSandboxAnalyzer extends Disposable {
+    constructor(_sandboxService, _configurationService) {
+        super();
+        this._sandboxService = _sandboxService;
+        this._configurationService = _configurationService;
+    }
+    _isAutoApproveEnabled() {
+        return this._configurationService.getValue(TerminalChatAgentToolsSettingId.EnableAutoApprove) !== false;
+    }
+    async analyze(_options) {
+        const isAutoApproveEnabled = this._isAutoApproveEnabled();
+        if (!(await this._sandboxService.isEnabled())) {
+            return {
+                isAutoApproveAllowed: isAutoApproveEnabled
+            };
+        }
+        return {
+            isAutoApproveAllowed: isAutoApproveEnabled,
+            forceAutoApproval: !_options.requiresUnsandboxConfirmation && !_options.requiresAllowNetworkConfirmation && isAutoApproveEnabled
+        };
+    }
+};
+CommandLineSandboxAnalyzer = ( __decorate([( __param(0, ITerminalSandboxService)), ( __param(1, IConfigurationService))], CommandLineSandboxAnalyzer));
+
+export { CommandLineSandboxAnalyzer };