@codingame/monaco-vscode-chat-service-override 33.0.9 → 34.0.0

package/vscode/src/vs/platform/sandbox/common/terminalSandboxEngine.d.ts

@@ -0,0 +1,182 @@
+import { Event } from "@codingame/monaco-vscode-api/vscode/vs/base/common/event";
+import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import { OperatingSystem } from "@codingame/monaco-vscode-api/vscode/vs/base/common/platform";
+import { URI } from "@codingame/monaco-vscode-api/vscode/vs/base/common/uri";
+import { IFileService } from "@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service";
+import { ILogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service";
+import { ISandboxDependencyStatus, type IWindowsMxcConfig, IWindowsMxcFilesystemPolicy, type IWindowsMxcPolicyContainment, type IWindowsMxcSandboxPolicy } from "@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/sandboxHelperService";
+import { IWindowsMxcTerminalSandboxRuntime } from "@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service";
+import { ITerminalSandboxCommand, ITerminalSandboxPrecheckInputs, ITerminalSandboxPrerequisiteCheckResult, ITerminalSandboxResolvedNetworkDomains, ITerminalSandboxWrapResult } from "./terminalSandboxService.js";
+/** Runtime information needed to launch the sandbox-runtime CLI. */
+export interface ITerminalSandboxRuntimeInfo {
+    /** Directory that contains `node_modules/@vscode/sandbox-runtime` and `node_modules/@vscode/ripgrep`. */
+    appRoot: string;
+    /** Path of the node/electron executable used to run sandbox-runtime. */
+    execPath?: string;
+    /**
+     * When true the engine prefixes the wrapped command with `ELECTRON_RUN_AS_NODE=1`
+     * so the Electron binary acts as a Node.js executable. Set by hosts that resolve
+     * an Electron-based exec path (the local workbench); leave undefined / false when
+     * `execPath` already points at a real `node` binary (remote, agent host).
+     */
+    runAsNode?: boolean;
+    /** CPU architecture of the environment that runs the sandbox runtime. */
+    arch?: string;
+}
+/**
+ * Host adapter that supplies the engine with environment/workspace data the
+ * platform layer cannot resolve on its own. Hosts (workbench, agent host)
+ * implement this to bridge their per-environment services (`IRemoteAgentService`,
+ * `IWorkspaceContextService`, `IEnvironmentService`, `IProductService`,
+ * `ISandboxHelperService`, …) into the engine.
+ */
+export interface ITerminalSandboxEngineHost {
+    /** Effective OS used by sandbox decisions. May be the remote OS in workbench. */
+    getOS(): Promise<OperatingSystem>;
+    /** Resolves app root + node/electron exec path (after the remote env is known, if applicable). */
+    getRuntimeInfo(): Promise<ITerminalSandboxRuntimeInfo>;
+    /** Resolves the user home used for `~`-expansion and the default deny-read entry. */
+    getUserHome(): Promise<URI | undefined>;
+    /**
+     * Resolves the directory the engine creates and uses as its sandbox temp dir
+     * (sandbox-settings JSON file lives here). May return undefined when no
+     * suitable location exists, in which case sandboxing is disabled.
+     */
+    getSandboxTempDir(): Promise<URI | undefined>;
+    /** Path added to `allowRead` and `allowWrite` for the engine's workspace/session storage area. */
+    getWorkspaceStorageReadRoot(): Promise<URI | undefined>;
+    /** Roots that must be writable inside the sandbox (workspace folders / session cwds). */
+    getWriteRoots(): readonly URI[];
+    /** Fires when {@link getWriteRoots} or {@link getWorkspaceStorageReadRoot} change. */
+    readonly onDidChangeRoots: Event<void>;
+    /** Resolves the installed sandbox-dependency status (bubblewrap, socat). */
+    checkSandboxDependencies(): Promise<ISandboxDependencyStatus | undefined>;
+    /** Resolves host filesystem policy fragments needed by the Windows MXC process container. */
+    getWindowsMxcFilesystemPolicy(): Promise<IWindowsMxcFilesystemPolicy | undefined>;
+    /** Resolves host environment variables needed by the Windows MXC process container. */
+    getWindowsMxcEnvironment(): Promise<string[] | undefined>;
+    /** Builds a Windows MXC payload from a target-environment MXC sandbox policy. */
+    buildWindowsMxcSandboxPayload(commandLine: string, policy: IWindowsMxcSandboxPolicy, workingDirectory?: string, containerName?: string, containment?: IWindowsMxcPolicyContainment): Promise<IWindowsMxcConfig | undefined>;
+    /**
+     * Returns the effective value of a sandbox-related configuration setting,
+     * or `undefined` when the setting is not configured. Implementations are
+     * responsible for mapping deprecated keys to modern ones (the engine
+     * only ever asks for the modern setting IDs).
+     */
+    getSandboxSetting<T>(settingId: string): T | undefined;
+    /**
+     * Fires when any value returned by {@link getSandboxSetting} may have
+     * changed. The engine invalidates its sandbox-config file on each event.
+     * Implementations should pre-filter to sandbox-relevant keys.
+     */
+    readonly onDidChangeSandboxSettings: Event<void>;
+}
+/**
+ * Core sandbox engine. Encapsulates the platform-agnostic logic for wrapping
+ * commands in a sandbox runtime: enabledness checks, command-line wrapping,
+ * sandbox-config generation, network-domain extraction and prerequisite checks.
+ *
+ * Hosts (workbench / agent host) construct an engine with a host adapter that
+ * supplies workspace/remote-specific data, then forward their public service
+ * methods to the engine and add their own host-specific concerns
+ * (chat elicitation, lifecycle hooks, …) on top.
+ */
+export declare class TerminalSandboxEngine extends Disposable {
+    private readonly _host;
+    private readonly _fileService;
+    private readonly _logService;
+    private readonly _windowsMxcRuntime;
+    private static readonly _urlRegex;
+    private static readonly _sshRemoteRegex;
+    private static readonly _hostRegex;
+    private readonly _sandboxSettingsId;
+    private _runtimeResolved;
+    private _appRoot;
+    private _execPath;
+    private _runAsNode;
+    private _userHome;
+    private _srtPath;
+    private _rgPath;
+    private _mxcPath;
+    private _windowsMxcFilesystemPolicy;
+    private _windowsMxcEnvironment;
+    private _sandboxConfigPath;
+    private _sandboxDependencyStatus;
+    private _needsForceUpdateConfigFile;
+    private _tempDir;
+    private _commandAllowListKeywords;
+    private _commandAllowListCommandDetails;
+    private _commandCwd;
+    private _commandLine;
+    private _commandShell;
+    private _commandAllowNetwork;
+    private _os;
+    private readonly _defaultWritePaths;
+    constructor(_host: ITerminalSandboxEngineHost, _fileService: IFileService, _logService: ILogService, _windowsMxcRuntime: IWindowsMxcTerminalSandboxRuntime);
+    isEnabled(precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<boolean>;
+    isSandboxAllowNetworkEnabled(precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<boolean>;
+    areUnsandboxedCommandsAllowed(): boolean;
+    areRetryWithAllowNetworkRequestsAllowed(): boolean;
+    isAutoApproveUnsandboxedCommands(): boolean;
+    getOS(): Promise<OperatingSystem>;
+    getTempDir(): URI | undefined;
+    setNeedsForceUpdateConfigFile(): void;
+    getResolvedNetworkDomains(): ITerminalSandboxResolvedNetworkDomains;
+    wrapCommand(command: string, requestUnsandboxedExecution?: boolean, shell?: string, cwd?: URI, commandDetails?: readonly ITerminalSandboxCommand[], requestAllowNetwork?: boolean): Promise<ITerminalSandboxWrapResult>;
+    checkForSandboxingPrereqs(forceRefresh?: boolean, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<ITerminalSandboxPrerequisiteCheckResult>;
+    getSandboxConfigPath(forceRefresh?: boolean, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<string | undefined>;
+    getMissingSandboxDependencies(): Promise<string[]>;
+    /**
+     * Deletes the sandbox temp directory if one was created. Hosts are expected
+     * to invoke this from their shutdown / disposal path; the engine itself does
+     * not delete the directory on `dispose()` because shutdown joiners need to
+     * be coordinated externally.
+     */
+    cleanupTempDir(): Promise<void>;
+    private _checkSandboxDependencies;
+    private _quoteShellArgument;
+    private _getSandboxCommandWithPreservedCwd;
+    private _wrapSandboxRuntimeCommandForLaunch;
+    private _wrapUnsandboxedCommand;
+    private _getBlockedDomains;
+    private _extractDomains;
+    private _extractDomainFromUrl;
+    private _normalizeCommandKeywords;
+    private _normalizeCommandDetails;
+    private _areStringArraysEqual;
+    private _areObjectsEqual;
+    private _isSandboxAllowedByPrecheckInputs;
+    private _isSandboxConfiguredEnabled;
+    private _resolveRuntimeInfo;
+    private _createSandboxConfig;
+    private readonly _buildSandboxPayload;
+    private _getCommandRuntimeFileSystemPaths;
+    private _withoutNetworkRuntimeSetting;
+    private _mergeAdditionalSandboxConfigProperties;
+    private _isObjectForSandboxConfigMerge;
+    private _getWindowsMxcFilesystemPolicy;
+    private _getWindowsMxcEnvironment;
+    private _pathJoin;
+    private _pathDirname;
+    private _getUriPath;
+    private _initTempDir;
+    private _updateAllowWritePathsWithWorkspaceFolders;
+    private _updateDenyReadPathsWithHome;
+    private _updateAllowReadPathsWithAllowWrite;
+    private _resolveFileSystemPaths;
+    private _resolveFileSystemPath;
+    private _isAbsoluteFileSystemPath;
+    private _toFileSystemResource;
+    private _toWindowsFileSystemResource;
+    private _expandHomePath;
+    private _getSandboxRuntimeReadPaths;
+    private _isPathUnderAppRoot;
+    private _getWorkspaceStorageReadPaths;
+    private _getDefaultWindowsMxcCwd;
+    private _getSandboxConfiguredEnabledValue;
+    private _getSandboxConfiguredWindowsEnabledValue;
+    private _isSandboxAllowNetworkConfigured;
+    private _areUnsandboxedCommandsAllowed;
+    private _areRetryWithAllowNetworkRequestsAllowed;
+    private _getSettingValue;
+}