@codingame/monaco-vscode-chat-service-override 34.1.2 → 35.0.0

package/vscode/src/vs/platform/sandbox/common/terminalSandboxEngine.js

@@ -2,21 +2,23 @@
 import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
 import { VSBuffer } from '@codingame/monaco-vscode-api/vscode/vs/base/common/buffer';
 import { Event } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
+import { match } from '@codingame/monaco-vscode-api/vscode/vs/base/common/glob';
 import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
 import { win32, posix } from '@codingame/monaco-vscode-api/vscode/vs/base/common/path';
 import { OS, OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
 import { arch } from '@codingame/monaco-vscode-api/vscode/vs/base/common/process';
+import { ExtUri } from '@codingame/monaco-vscode-api/vscode/vs/base/common/resources';
 import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
 import { generateUuid } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uuid';
 import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service';
 import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
 import { matchesDomainPattern, normalizeDomain } from '../../networkFilter/common/domainMatcher.js';
 import { AgentNetworkDomainSettingId } from '../../networkFilter/common/settings.js';
-import { AgentSandboxSettingId, AgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
+import { isAgentSandboxEnabledValue, AgentSandboxSettingId, AgentSandboxEnabledValue, normalizeAgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
 import { IWindowsMxcTerminalSandboxRuntime } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service';
 import { getTerminalSandboxReadAllowListForCommands } from './terminalSandboxReadAllowList.js';
 import { getTerminalSandboxRuntimeConfigurationForCommands } from './terminalSandboxRuntimeConfigurationPerOperation.js';
-import { TerminalSandboxPrerequisiteCheck } from './terminalSandboxService.js';
+import { TerminalSandboxPrerequisiteCheck, TerminalSandboxPreCheckRemediation } from './terminalSandboxService.js';
 
 var TerminalSandboxEngine_1;
 let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
@@ -47,6 +49,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         this._commandAllowNetwork = false;
         this._os = OS;
         this._defaultWritePaths = [];
+        this._fileSystemPathExtUri = ( new ExtUri(() => this._os === OperatingSystem.Windows));
         this._buildSandboxPayload = (commandLine, policy, workingDirectory, containerName, containment) => {
             return this._host.buildWindowsMxcSandboxPayload(commandLine, policy, workingDirectory, containerName, containment);
         };
@@ -74,9 +77,6 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
     areRetryWithAllowNetworkRequestsAllowed() {
         return this._areRetryWithAllowNetworkRequestsAllowed();
     }
-    isAutoApproveUnsandboxedCommands() {
-        return this._areUnsandboxedCommandsAllowed() && this._getSettingValue(AgentSandboxSettingId.AgentSandboxAutoApproveUnsandboxedCommands) === true;
-    }
     async getOS() {
         this._os = await this._host.getOS();
         return this._os;
@@ -209,11 +209,21 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             };
         }
         if (!(await this._checkSandboxDependencies(forceRefresh))) {
+            const missingDependencies = await this.getMissingSandboxDependencies();
+            if (missingDependencies.length === 0 && this._sandboxDependencyStatus?.bubblewrapInstalled && !this._sandboxDependencyStatus.bubblewrapUsable) {
+                return {
+                    enabled: true,
+                    sandboxConfigPath,
+                    failedCheck: TerminalSandboxPrerequisiteCheck.Bubblewrap,
+                    remediations: this._getBubblewrapRemediations(),
+                    detail: this._sandboxDependencyStatus.bubblewrapError
+                };
+            }
             return {
                 enabled: true,
                 sandboxConfigPath,
                 failedCheck: TerminalSandboxPrerequisiteCheck.Dependencies,
-                missingDependencies: await this.getMissingSandboxDependencies()
+                missingDependencies
             };
         }
         return {
@@ -222,6 +232,32 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             failedCheck: undefined
         };
     }
+    async checkFileAccess(permission, paths, precheckInputs) {
+        if (!(await this._isSandboxConfiguredEnabled(precheckInputs))) {
+            return {
+                allowed: true,
+                denied: []
+            };
+        }
+        await this._resolveRuntimeInfo();
+        if (!this._tempDir) {
+            await this._initTempDir();
+        }
+        const configFilePath = this._tempDir ? this._getUriPath(
+            URI.joinPath(this._tempDir, `vscode-sandbox-settings-${this._sandboxSettingsId}.json`)
+        ) : undefined;
+        const accessPaths = await this._getFileSystemAccessPaths(configFilePath);
+        const denied = [];
+        for (const path of paths) {
+            if (!path || !(await this._hasFileSystemAccess(permission, path, accessPaths))) {
+                denied.push(path);
+            }
+        }
+        return {
+            allowed: denied.length === 0,
+            denied
+        };
+    }
     async getSandboxConfigPath(forceRefresh = false, precheckInputs) {
         if (!(await this._isSandboxConfiguredEnabled(precheckInputs))) {
             return undefined;
@@ -238,7 +274,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         if (os === OperatingSystem.Windows) {
             return [];
         }
-        if (!this._sandboxDependencyStatus || !this._sandboxDependencyStatus.bubblewrapInstalled || !this._sandboxDependencyStatus.socatInstalled) {
+        if (!this._sandboxDependencyStatus) {
             this._sandboxDependencyStatus = await this._host.checkSandboxDependencies();
         }
         const missing = [];
@@ -269,17 +305,27 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             return true;
         }
         if (!forceRefresh && this._sandboxDependencyStatus) {
-            return this._sandboxDependencyStatus.bubblewrapInstalled && this._sandboxDependencyStatus.socatInstalled;
+            return this._sandboxDependencyStatus.bubblewrapInstalled && this._sandboxDependencyStatus.bubblewrapUsable && this._sandboxDependencyStatus.socatInstalled;
         }
         const status = await this._host.checkSandboxDependencies();
         this._sandboxDependencyStatus = status;
         if (status && !status.bubblewrapInstalled) {
             this._logService.warn("TerminalSandboxEngine: bubblewrap (bwrap) is not installed");
+        } else if (status && !status.bubblewrapUsable) {
+            this._logService.warn(
+                "TerminalSandboxEngine: bubblewrap (bwrap) is installed but failed its capability check",
+                status.bubblewrapError
+            );
         }
         if (status && !status.socatInstalled) {
             this._logService.warn("TerminalSandboxEngine: socat is not installed");
         }
-        return status ? status.bubblewrapInstalled && status.socatInstalled : true;
+        return status ? status.bubblewrapInstalled && status.bubblewrapUsable && status.socatInstalled : true;
+    }
+    _getBubblewrapRemediations() {
+        return [
+            TerminalSandboxPreCheckRemediation.DisableUnprivilagedusernamespaceRestriction
+        ];
     }
     _quoteShellArgument(value) {
         return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -411,10 +457,11 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         }
         await this.getOS();
         if (this._os === OperatingSystem.Windows) {
-            return this._getSandboxConfiguredWindowsEnabledValue() === AgentSandboxEnabledValue.AllowNetwork;
+            const value = this._getSandboxConfiguredWindowsEnabledValue();
+            return isAgentSandboxEnabledValue(value);
         }
         const value = this._getSandboxConfiguredEnabledValue();
-        return value === AgentSandboxEnabledValue.On || value === AgentSandboxEnabledValue.AllowNetwork;
+        return isAgentSandboxEnabledValue(value);
     }
     async _resolveRuntimeInfo() {
         if (this._runtimeResolved) {
@@ -464,6 +511,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowRead");
         const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowWrite");
         const configFileUri = URI.joinPath(this._tempDir, `vscode-sandbox-settings-${this._sandboxSettingsId}.json`);
+        const configFilePath = this._getUriPath(configFileUri);
         let allowWritePaths = [];
         let allowReadPaths = [];
         let denyReadPaths = [];
@@ -482,26 +530,30 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             denyReadPaths = await this._resolveFileSystemPaths(windowsFileSystemSetting.denyRead ?? []);
             this._windowsMxcEnvironment = env;
         } else if (this._os === OperatingSystem.Macintosh) {
-            allowWritePaths = await this._resolveFileSystemPaths(
+            allowWritePaths = (await this._resolveFileSystemPaths(
                 await this._updateAllowWritePathsWithWorkspaceFolders(macFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths)
-            );
+            )).filter(path => path !== configFilePath);
             allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(
                 macFileSystemSetting.allowRead,
                 allowWritePaths,
                 commandRuntimeAllowReadPaths
             ));
-            denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome(macFileSystemSetting.denyRead));
+            denyReadPaths = await this._resolveFileSystemPaths(
+                this._updateDenyReadPathsWithHome([...(macFileSystemSetting.denyRead ?? []), configFilePath])
+            );
             denyWritePaths = macFileSystemSetting.denyWrite ? await this._resolveFileSystemPaths(macFileSystemSetting.denyWrite) : undefined;
         } else if (this._os === OperatingSystem.Linux) {
-            allowWritePaths = await this._resolveFileSystemPaths(
+            allowWritePaths = (await this._resolveFileSystemPaths(
                 await this._updateAllowWritePathsWithWorkspaceFolders(linuxFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths)
-            );
+            )).filter(path => path !== configFilePath);
             allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(
                 linuxFileSystemSetting.allowRead,
                 allowWritePaths,
                 commandRuntimeAllowReadPaths
             ));
-            denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome(linuxFileSystemSetting.denyRead));
+            denyReadPaths = await this._resolveFileSystemPaths(
+                this._updateDenyReadPathsWithHome([...(linuxFileSystemSetting.denyRead ?? []), configFilePath])
+            );
             denyWritePaths = await this._resolveFileSystemPaths(linuxFileSystemSetting.denyWrite);
         }
         const sandboxSettings = this._os === OperatingSystem.Windows ? await this._windowsMxcRuntime.createConfig({
@@ -511,7 +563,6 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             tempDir: this._tempDir,
             schemaVersion: windowsSchemaVersion,
             allowNetwork,
-            networkDomains: this.getResolvedNetworkDomains(),
             allowReadPaths,
             allowWritePaths,
             denyReadPaths,
@@ -530,13 +581,14 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             }
         };
         if (this._os !== OperatingSystem.Windows) {
-            this._mergeAdditionalSandboxConfigProperties(
-                sandboxSettings,
-                allowNetwork ? this._withoutNetworkRuntimeSetting(runtimeSetting) : runtimeSetting
-            );
-            this._mergeAdditionalSandboxConfigProperties(sandboxSettings, commandRuntimeSetting);
+            const sandboxRuntimeSettings = sandboxSettings;
+            this._mergeAdditionalSandboxConfigProperties(sandboxRuntimeSettings, runtimeSetting);
+            this._mergeAdditionalSandboxConfigProperties(sandboxRuntimeSettings, commandRuntimeSetting);
+            if (this._os === OperatingSystem.Macintosh) {
+                sandboxRuntimeSettings.allowPty ??= true;
+            }
         }
-        this._sandboxConfigPath = this._getUriPath(configFileUri);
+        this._sandboxConfigPath = configFilePath;
         await this._fileService.createFile(
             configFileUri,
             VSBuffer.fromString(JSON.stringify(sandboxSettings, null, "\t")),
@@ -546,6 +598,122 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         );
         return this._sandboxConfigPath;
     }
+    async _getFileSystemAccessPaths(configFilePath) {
+        const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {} : {};
+        const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {} : {};
+        const windowsFileSystemSetting = this._os === OperatingSystem.Windows ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {} : {};
+        const commandRuntimeSetting = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
+        const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowRead");
+        const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowWrite");
+        let allowWritePaths = [];
+        let allowReadPaths = [];
+        let denyReadPaths = [];
+        let denyWritePaths;
+        if (this._os === OperatingSystem.Windows) {
+            const filesystemPolicy = await this._getWindowsMxcFilesystemPolicy();
+            allowWritePaths = await this._resolveFileSystemPaths([
+                ...(await this._updateAllowWritePathsWithWorkspaceFolders(windowsFileSystemSetting.allowWrite)),
+                ...filesystemPolicy.readwritePaths
+            ]);
+            allowReadPaths = await this._resolveFileSystemPaths([
+                ...(windowsFileSystemSetting.allowRead ?? []),
+                ...filesystemPolicy.readonlyPaths
+            ]);
+            denyReadPaths = await this._resolveFileSystemPaths(windowsFileSystemSetting.denyRead ?? []);
+        } else if (this._os === OperatingSystem.Macintosh) {
+            allowWritePaths = (await this._resolveFileSystemPaths(
+                await this._updateAllowWritePathsWithWorkspaceFolders(macFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths)
+            )).filter(path => path !== configFilePath);
+            allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(
+                macFileSystemSetting.allowRead,
+                allowWritePaths,
+                commandRuntimeAllowReadPaths
+            ));
+            denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome([
+                ...(macFileSystemSetting.denyRead ?? []),
+                ...(configFilePath ? [configFilePath] : [])
+            ]));
+            denyWritePaths = macFileSystemSetting.denyWrite ? await this._resolveFileSystemPaths(macFileSystemSetting.denyWrite) : undefined;
+        } else if (this._os === OperatingSystem.Linux) {
+            allowWritePaths = (await this._resolveFileSystemPaths(
+                await this._updateAllowWritePathsWithWorkspaceFolders(linuxFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths)
+            )).filter(path => path !== configFilePath);
+            allowReadPaths = await this._resolveFileSystemPaths(await this._updateAllowReadPathsWithAllowWrite(
+                linuxFileSystemSetting.allowRead,
+                allowWritePaths,
+                commandRuntimeAllowReadPaths
+            ));
+            denyReadPaths = await this._resolveFileSystemPaths(this._updateDenyReadPathsWithHome([
+                ...(linuxFileSystemSetting.denyRead ?? []),
+                ...(configFilePath ? [configFilePath] : [])
+            ]));
+            denyWritePaths = await this._resolveFileSystemPaths(linuxFileSystemSetting.denyWrite);
+        }
+        return {
+            allowReadPaths,
+            allowWritePaths,
+            denyReadPaths,
+            denyWritePaths
+        };
+    }
+    async _hasFileSystemAccess(permission, path, accessPaths) {
+        const resolvedPaths = await this._resolveFileSystemPath(path);
+        if (permission === "write") {
+            if (this._os === OperatingSystem.Windows && this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.denyReadPaths)) {
+                return false;
+            }
+            if (this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.denyWritePaths ?? [])) {
+                return false;
+            }
+            return this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.allowWritePaths);
+        }
+        if (this._matchesAnyFileSystemPath(
+            resolvedPaths,
+            [...accessPaths.allowReadPaths, ...accessPaths.allowWritePaths]
+        )) {
+            return true;
+        }
+        return !this._matchesAnyFileSystemPath(resolvedPaths, accessPaths.denyReadPaths);
+    }
+    _matchesAnyFileSystemPath(paths, matchers) {
+        return ( paths.some(path => ( matchers.some(matcher => this._matchesFileSystemPath(path, matcher)))));
+    }
+    _matchesFileSystemPath(path, matcher) {
+        const normalizedPath = this._normalizeFileSystemAccessPath(path);
+        const normalizedMatcher = this._normalizeFileSystemAccessPath(matcher, true);
+        const ignoreCase = this._os === OperatingSystem.Windows;
+        if (this._containsGlobPattern(normalizedMatcher)) {
+            return match(normalizedMatcher, normalizedPath, {
+                ignoreCase
+            });
+        }
+        return this._fileSystemPathExtUri.isEqualOrParent(
+            this._toFileSystemAccessUri(normalizedPath),
+            this._toFileSystemAccessUri(normalizedMatcher)
+        );
+    }
+    _toFileSystemAccessUri(path) {
+        return ( URI.from({
+            scheme: "terminal-sandbox-path",
+            path: path.startsWith("/") ? path : `/${path}`
+        }));
+    }
+    _normalizeFileSystemAccessPath(path, preserveGlob = false) {
+        let normalizedPath = this._os === OperatingSystem.Windows ? path.replace(/\\/g, "/") : path;
+        if (this._os === OperatingSystem.Windows && /^\/[a-zA-Z]:($|\/)/.test(normalizedPath)) {
+            normalizedPath = normalizedPath.slice(1);
+        }
+        if (!preserveGlob || !this._containsGlobPattern(normalizedPath)) {
+            normalizedPath = posix.normalize(normalizedPath);
+        }
+        if (normalizedPath.length > 1 && normalizedPath.endsWith("/") && !/^[a-zA-Z]:\/$/.test(normalizedPath)) {
+            normalizedPath = normalizedPath.replace(/\/+$/, "");
+        }
+        return normalizedPath;
+    }
+    _containsGlobPattern(path) {
+        return /[*?{\[]/.test(path);
+    }
     _getCommandRuntimeFileSystemPaths(runtimeSetting, key) {
         const filesystem = runtimeSetting.filesystem;
         if (!this._isObjectForSandboxConfigMerge(filesystem)) {
@@ -557,13 +725,6 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         }
         return paths.filter(path => typeof path === "string");
     }
-    _withoutNetworkRuntimeSetting(runtimeSetting) {
-        const sanitizedRuntimeSetting = {
-            ...runtimeSetting
-        };
-        delete sanitizedRuntimeSetting.network;
-        return sanitizedRuntimeSetting;
-    }
     _mergeAdditionalSandboxConfigProperties(target, additional) {
         for (const [key, value] of Object.entries(additional)) {
             if (!Object.prototype.hasOwnProperty.call(target, key)) {
@@ -648,7 +809,18 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
     }
     async _resolveFileSystemPaths(paths) {
         const resolvedPaths = await Promise.all(( (paths ?? []).map(path => this._resolveFileSystemPath(path))));
-        return [...( new Set(resolvedPaths.flat()))];
+        const seenPaths = ( new Set());
+        return resolvedPaths.flat().filter(path => {
+            const comparisonKey = this._getFileSystemPathComparisonKey(path);
+            if (( seenPaths.has(comparisonKey))) {
+                return false;
+            }
+            seenPaths.add(comparisonKey);
+            return true;
+        });
+    }
+    _getFileSystemPathComparisonKey(path) {
+        return this._os === OperatingSystem.Windows ? path.replace(/\//g, "\\").toLowerCase() : path;
     }
     async _resolveFileSystemPath(path) {
         const expandedPath = this._os === OperatingSystem.Linux ? this._expandHomePath(path) : path;
@@ -758,12 +930,18 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         return this._host.getWriteRoots()[0];
     }
     _getSandboxConfiguredEnabledValue() {
-        return this._getSettingValue(AgentSandboxSettingId.AgentSandboxEnabled) ?? AgentSandboxEnabledValue.Off;
+        return this._normalizeSandboxEnabledValue(this._getSettingValue(AgentSandboxSettingId.AgentSandboxEnabled));
     }
     _getSandboxConfiguredWindowsEnabledValue() {
-        return this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsEnabled) ?? AgentSandboxEnabledValue.Off;
+        return this._normalizeSandboxEnabledValue(this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsEnabled));
+    }
+    _normalizeSandboxEnabledValue(value) {
+        return value === undefined ? AgentSandboxEnabledValue.Off : normalizeAgentSandboxEnabledValue(value);
     }
     _isSandboxAllowNetworkConfigured() {
+        if (this._getSettingValue(AgentSandboxSettingId.AgentSandboxAllowNetwork) === true) {
+            return true;
+        }
         if (this._os === OperatingSystem.Windows) {
             return this._getSandboxConfiguredWindowsEnabledValue() === AgentSandboxEnabledValue.AllowNetwork;
         }

package/vscode/src/vs/platform/sandbox/common/terminalSandboxReadAllowList.js

@@ -1,6 +1,6 @@
 
 import { OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
-import { gitGlobalOptionsWithValue, matchesTerminalSandboxCommandRule } from './terminalSandboxCommandRules.js';
+import { matchesTerminalSandboxCommandRule } from './terminalSandboxCommandRules.js';
 
 var TerminalSandboxReadAllowListOperation;
 (function(TerminalSandboxReadAllowListOperation) {
@@ -84,6 +84,7 @@ function getTerminalSandboxReadAllowListForOperation(operation, os) {
         default:
             return [
                 "~/.gitconfig",
+                "~/.config/gh/config.yml",
                 "~/.config/git/config",
                 "~/.gitignore",
                 "~/.gitignore_global",
@@ -280,9 +281,7 @@ const terminalSandboxReadAllowListCommandDetailRules = [{
     value: TerminalSandboxReadAllowListOperation.GnuPG
 }, {
     keywords: ["git"],
-    value: TerminalSandboxReadAllowListOperation.GnuPG,
-    subcommands: ["commit"],
-    optionsWithValue: gitGlobalOptionsWithValue
+    value: TerminalSandboxReadAllowListOperation.GnuPG
 }];
 function getTerminalSandboxReadAllowListForCommands(os, commandKeywords, commandDetails = []) {
     if (commandKeywords.length === 0) {

package/vscode/src/vs/platform/sandbox/common/terminalSandboxRuntimeConfigurationPerOperation.js

@@ -1,6 +1,6 @@
 
 import { OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
-import { gitGlobalOptionsWithValue, matchesTerminalSandboxCommandRule } from './terminalSandboxCommandRules.js';
+import { matchesTerminalSandboxCommandRule } from './terminalSandboxCommandRules.js';
 
 var TerminalSandboxRuntimeConfigurationOperation;
 (function(TerminalSandboxRuntimeConfigurationOperation) {
@@ -29,15 +29,13 @@ const terminalSandboxRuntimeConfigurationCommandRules = [{
 }, {
     keywords: ["git"],
     value: TerminalSandboxRuntimeConfigurationOperation.GnuPG,
-    subcommands: ["commit"],
-    optionsWithValue: gitGlobalOptionsWithValue,
     condition: (
         {
             os
         }
-    ) => os !== OperatingSystem.Windows,
-    when: isGpgSignedGitCommit
+    ) => os !== OperatingSystem.Windows
 }];
+const terminalSandboxGnuPGCompatibleCommandKeywords = ( new Set(["git", "gh", "gpg", "gpg2"]));
 function getTerminalSandboxRuntimeConfigurationForOperation(operation, os) {
     switch (operation) {
     case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
@@ -78,7 +76,7 @@ function getTerminalSandboxRuntimeConfigurationForCommands(os, commandDetails) {
         for (const rule of terminalSandboxRuntimeConfigurationCommandRules) {
             if (matchesTerminalSandboxCommandRule(command, rule, {
                 os
-            })) {
+            }) && shouldApplyRuntimeConfigurationOperation(rule.value, commandDetails)) {
                 operations.add(rule.value);
             }
         }
@@ -92,10 +90,13 @@ function getTerminalSandboxRuntimeConfigurationForCommands(os, commandDetails) {
     }
     return configuration;
 }
-function isGpgSignedGitCommit(command) {
-    return ( command.args.some(
-        arg => arg === "-S" || arg.startsWith("-S") || arg === "--gpg-sign" || arg.startsWith("--gpg-sign=")
-    ));
+function shouldApplyRuntimeConfigurationOperation(operation, commandDetails) {
+    switch (operation) {
+    case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
+        return commandDetails.every(command => ( terminalSandboxGnuPGCompatibleCommandKeywords.has(command.keyword.toLowerCase())));
+    case TerminalSandboxRuntimeConfigurationOperation.Node:
+        return true;
+    }
 }
 function mergeAdditionalSandboxConfigProperties(target, additional) {
     for (const [key, value] of Object.entries(additional)) {

package/vscode/src/vs/platform/sandbox/common/terminalSandboxService.d.ts

@@ -9,13 +9,19 @@ export interface ITerminalSandboxResolvedNetworkDomains {
 }
 export declare enum TerminalSandboxPrerequisiteCheck {
     Config = "config",
-    Dependencies = "dependencies"
+    Dependencies = "dependencies",
+    Bubblewrap = "bubblewrap"
+}
+export declare enum TerminalSandboxPreCheckRemediation {
+    DisableUnprivilagedusernamespaceRestriction = "disableUserNamespaceRestriction"
 }
 export interface ITerminalSandboxPrerequisiteCheckResult {
     enabled: boolean;
     sandboxConfigPath: string | undefined;
     failedCheck: TerminalSandboxPrerequisiteCheck | undefined;
     missingDependencies?: string[];
+    remediations?: readonly TerminalSandboxPreCheckRemediation[];
+    detail?: string;
 }
 export interface ITerminalSandboxWrapResult {
     command: string;
@@ -25,11 +31,10 @@ export interface ITerminalSandboxWrapResult {
     requiresUnsandboxConfirmation?: boolean;
     requiresAllowNetworkConfirmation?: boolean;
 }
-export interface ITerminalSandboxPrecheckInputs {
-    /**
-     * Whether the current caller is using the default approval permission flow.
-     */
-    readonly isDefaultApprovalPermissionEnabled?: boolean;
+export type TerminalSandboxFileAccessPermission = "read" | "write";
+export interface ITerminalSandboxFileAccessCheckResult {
+    allowed: boolean;
+    denied: string[];
 }
 export interface ITerminalSandboxPrecheckInputs {
     /**
@@ -91,10 +96,12 @@ export declare class NullTerminalSandboxService implements ITerminalSandboxServi
     getOS(): Promise<OperatingSystem>;
     checkForSandboxingPrereqs(): Promise<ITerminalSandboxPrerequisiteCheckResult>;
     wrapCommand(command: string): Promise<ITerminalSandboxWrapResult>;
+    checkFileAccess(): Promise<ITerminalSandboxFileAccessCheckResult>;
     getSandboxConfigPath(): Promise<string | undefined>;
     getTempDir(): URI | undefined;
     setNeedsForceUpdateConfigFile(): void;
     getResolvedNetworkDomains(): ITerminalSandboxResolvedNetworkDomains;
     getMissingSandboxDependencies(): Promise<string[]>;
     installMissingSandboxDependencies(): Promise<ISandboxDependencyInstallResult>;
+    runSandboxRemediation(): Promise<ISandboxDependencyInstallResult>;
 }

package/vscode/src/vs/platform/sandbox/common/terminalSandboxService.js

@@ -5,6 +5,11 @@ var TerminalSandboxPrerequisiteCheck;
 (function (TerminalSandboxPrerequisiteCheck) {
     TerminalSandboxPrerequisiteCheck["Config"] = "config";
     TerminalSandboxPrerequisiteCheck["Dependencies"] = "dependencies";
+    TerminalSandboxPrerequisiteCheck["Bubblewrap"] = "bubblewrap";
 })(TerminalSandboxPrerequisiteCheck || (TerminalSandboxPrerequisiteCheck = {}));
+var TerminalSandboxPreCheckRemediation;
+(function (TerminalSandboxPreCheckRemediation) {
+    TerminalSandboxPreCheckRemediation["DisableUnprivilagedusernamespaceRestriction"] = "disableUserNamespaceRestriction";
+})(TerminalSandboxPreCheckRemediation || (TerminalSandboxPreCheckRemediation = {}));
 
-export { TerminalSandboxPrerequisiteCheck };
+export { TerminalSandboxPreCheckRemediation, TerminalSandboxPrerequisiteCheck };

package/vscode/src/vs/workbench/contrib/agentsVoice/browser/agentsVoice.contribution.d.ts

@@ -0,0 +1,2 @@
+import { RawContextKey } from "@codingame/monaco-vscode-api/vscode/vs/platform/contextkey/common/contextkey";
+export declare const AGENTS_VOICE_WIDGET_FOCUSED: RawContextKey<boolean>;