@codingame/monaco-vscode-chat-service-override 36.2.7 → 37.0.0

package/vscode/src/vs/platform/chat/common/aiAgentEnv.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Cross-vendor convention env var that announces which AI agent is driving a
+ * process. Child processes inherit it; `gh` in particular reads it and reports
+ * the value in its `User-Agent`, which lets downstream activity be attributed to
+ * the originating AI experience without touching the user's global environment.
+ */
+export declare const AiAgentEnvVar = "AI_AGENT";
+/**
+ * The value VS Code announces for processes it spawns on behalf of an agent
+ * session, following the `github_copilot_<surface>` form asked of every GitHub
+ * Copilot surface. Must stay stable: it is a wire contract with the reporting
+ * pipeline, and `gh` only accepts values matching `[a-zA-Z0-9_-]+`.
+ *
+ * This must be set for *every* process an agent session spawns — the local
+ * (in-workbench) harness terminal tool, the agent host process and every agent
+ * SDK subprocess it launches — otherwise the surface is under-counted.
+ */
+export declare const AiAgentEnvValue = "github_copilot_vscode_agent";

package/vscode/src/vs/platform/chat/common/aiAgentEnv.js

@@ -0,0 +1,6 @@
+
+
+const AiAgentEnvVar = 'AI_AGENT';
+const AiAgentEnvValue = 'github_copilot_vscode_agent';
+
+export { AiAgentEnvValue, AiAgentEnvVar };

package/vscode/src/vs/platform/networkFilter/common/domainMatcher.d.ts

@@ -10,6 +10,10 @@ import { URI } from "@codingame/monaco-vscode-api/vscode/vs/base/common/uri";
  * @returns The normalized domain string, or `undefined` if the input is invalid.
  */
 export declare function normalizeDomain(value: string | undefined, fromUrl?: boolean): string | undefined;
+/**
+ * Normalizes an administrator allow/deny pattern to the canonical host form used for matching.
+ */
+export declare function normalizeDomainPattern(pattern: string): string | undefined;
 /**
  * Extracts the domain portion from a pattern string.
  * If the pattern contains `://`, it is parsed as a URI and the authority is returned.
@@ -27,7 +31,7 @@ export declare function extractDomainPattern(pattern: string): string;
 export declare function matchesDomainPattern(domain: string, pattern: string): boolean;
 /**
  * Extracts and normalizes a domain from a URI.
- * Strips port numbers and trailing dots.
+ * Separates user information and ports, and canonicalizes IPv6 literals.
  *
  * @param uri The URI to extract the domain from.
  * @returns The normalized domain, or `undefined` if no valid domain could be extracted.

package/vscode/src/vs/platform/networkFilter/common/domainMatcher.js

@@ -91,6 +91,77 @@ function normalizeDomain(value, fromUrl = false) {
     }
     return hasWildcardPrefix ? `*.${host}` : host;
 }
+function normalizeUriAuthority(authority) {
+    if (!authority || /[/?#\\]/.test(authority)) {
+        return undefined;
+    }
+    let hostname;
+    try {
+        const url = ( new URL(`http://${authority}`));
+        if (hasHostLikeCredentials(url)) {
+            return undefined;
+        }
+        hostname = url.hostname.toLowerCase();
+    } catch {
+        return undefined;
+    }
+    if (hostname.startsWith("[")) {
+        return hostname.endsWith("]") ? hostname : undefined;
+    }
+    return normalizeDomain(hostname, true);
+}
+function hasHostLikeCredentials(url) {
+    return ( [url.username, url.password].some(value => {
+        if (!value) {
+            return false;
+        }
+        let decoded;
+        try {
+            decoded = decodeURIComponent(value).toLowerCase();
+        } catch {
+            return true;
+        }
+        if (decoded.includes("@")) {
+            return false;
+        }
+        return (decoded.includes(".") && normalizeDomain(decoded, true) !== undefined) || normalizeBareIpv6(decoded) !== undefined;
+    }));
+}
+function normalizeBareIpv6(value) {
+    if (!value.includes(":") || /[/?#\\@\[\]]/.test(value)) {
+        return undefined;
+    }
+    return normalizeUriAuthority(`[${value}]`);
+}
+function normalizeDomainPattern(pattern) {
+    const extractedPattern = extractDomainPattern(pattern);
+    if (extractedPattern === "*") {
+        return extractedPattern;
+    }
+    if (extractedPattern.startsWith("*.")) {
+        const normalizedPattern = normalizeDomain(extractedPattern, true);
+        if (!normalizedPattern) {
+            return undefined;
+        }
+        const suffix = normalizedPattern.slice(2);
+        return `*.${normalizeUriAuthority(suffix) ?? suffix}`;
+    }
+    return normalizeBareIpv6(extractedPattern) ?? normalizeUriAuthority(extractedPattern) ?? normalizeDomain(extractedPattern, true);
+}
+function normalizeEmbeddedIpv4(value) {
+    const mappedMatch = /^\[::ffff:(?<high>[0-9a-f]{1,4}):(?<low>[0-9a-f]{1,4})\]$/.exec(value);
+    const compatibleMatch = mappedMatch ? undefined : /^\[::(?:(?<high>[0-9a-f]{1,4}):)?(?<low>[0-9a-f]{1,4})\]$/.exec(value);
+    const groups = (mappedMatch ?? compatibleMatch)?.groups;
+    if (!groups) {
+        return undefined;
+    }
+    const high = Number.parseInt(groups.high ?? "0", 16);
+    const low = Number.parseInt(groups.low, 16);
+    if (compatibleMatch && high === 0 && low <= 1) {
+        return undefined;
+    }
+    return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;
+}
 function extractDomainPattern(pattern) {
     const trimmed = pattern.trim();
     if (trimmed === "*") {
@@ -106,7 +177,7 @@ function extractDomainPattern(pattern) {
     }
 }
 function matchesDomainPattern(domain, pattern) {
-    const normalizedPattern = normalizeDomain(extractDomainPattern(pattern), pattern.includes("://"));
+    const normalizedPattern = normalizeDomainPattern(pattern);
     if (!normalizedPattern) {
         return false;
     }
@@ -115,12 +186,13 @@ function matchesDomainPattern(domain, pattern) {
     }
     if (normalizedPattern.startsWith("*.")) {
         const suffix = normalizedPattern.slice(2);
-        return domain === suffix || domain.endsWith(`.${suffix}`);
+        const normalizedDomain = normalizeEmbeddedIpv4(domain) ?? domain;
+        return normalizedDomain === suffix || normalizedDomain.endsWith(`.${suffix}`);
     }
-    return domain === normalizedPattern;
+    return (normalizeEmbeddedIpv4(domain) ?? domain) === (normalizeEmbeddedIpv4(normalizedPattern) ?? normalizedPattern);
 }
 function extractDomainFromUri(uri) {
-    return normalizeDomain(uri.authority, true);
+    return normalizeUriAuthority(uri.authority);
 }
 function isDomainAllowed(domain, allowedPatterns, deniedPatterns) {
     if (allowedPatterns.length === 0 && deniedPatterns.length === 0) {
@@ -135,4 +207,4 @@ function isDomainAllowed(domain, allowedPatterns, deniedPatterns) {
     return ( allowedPatterns.some(pattern => matchesDomainPattern(domain, pattern)));
 }
 
-export { extractDomainFromUri, extractDomainPattern, isDomainAllowed, matchesDomainPattern, normalizeDomain };
+export { extractDomainFromUri, extractDomainPattern, isDomainAllowed, matchesDomainPattern, normalizeDomain, normalizeDomainPattern };

package/vscode/src/vs/platform/networkFilter/common/networkFilterService.d.ts

@@ -14,6 +14,6 @@ export declare class AgentNetworkFilterService extends Disposable implements IAg
     constructor(configurationService: IConfigurationService);
     private readConfiguration;
     isUriAllowed(uri: URI): boolean;
-    private shouldFilter;
+    isEnabled(): boolean;
     formatError(uri: URI): string;
 }

package/vscode/src/vs/platform/networkFilter/common/networkFilterService.js

@@ -3,11 +3,15 @@ import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib
 import { Emitter } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
 import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
 import { LRUCache } from '@codingame/monaco-vscode-api/vscode/vs/base/common/map';
+import { matchesScheme, Schemas } from '@codingame/monaco-vscode-api/vscode/vs/base/common/network';
 import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
 import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
 import { extractDomainFromUri, isDomainAllowed } from './domainMatcher.js';
 import { AgentNetworkDomainSettingId } from './settings.js';
 
+function isFilteredNetworkScheme(uri) {
+    return matchesScheme(uri, Schemas.http) || matchesScheme(uri, Schemas.https) || matchesScheme(uri, "ws") || matchesScheme(uri, "wss");
+}
 let AgentNetworkFilterService = class AgentNetworkFilterService extends Disposable {
     constructor(configurationService) {
         super();
@@ -34,15 +38,15 @@ let AgentNetworkFilterService = class AgentNetworkFilterService extends Disposab
         this.domainCache.clear();
     }
     isUriAllowed(uri) {
-        if (!this.shouldFilter()) {
+        if (!this.isEnabled()) {
             return true;
         }
-        if (uri.scheme === "file" || !uri.authority) {
+        if (matchesScheme(uri, Schemas.file) || (!uri.authority && !isFilteredNetworkScheme(uri))) {
             return true;
         }
         const domain = extractDomainFromUri(uri);
         if (!domain) {
-            return true;
+            return !isFilteredNetworkScheme(uri);
         }
         let result = this.domainCache.get(domain);
         if (result === undefined) {
@@ -51,13 +55,13 @@ let AgentNetworkFilterService = class AgentNetworkFilterService extends Disposab
         }
         return result;
     }
-    shouldFilter() {
+    isEnabled() {
         return this.networkFilterEnabled;
     }
     formatError(uri) {
         const domain = extractDomainFromUri(uri);
         return localize(
-            2189,
+            2363,
             "Access to {0} is blocked by network domain policy (see `{1}` and `{2}` settings).",
             domain ?? uri.authority,
             AgentNetworkDomainSettingId.AllowedNetworkDomains,

package/vscode/src/vs/platform/networkFilter/common/settings.d.ts

@@ -4,9 +4,5 @@
 export declare enum AgentNetworkDomainSettingId {
     NetworkFilter = "chat.agent.networkFilter",
     AllowedNetworkDomains = "chat.agent.allowedNetworkDomains",
-    DeniedNetworkDomains = "chat.agent.deniedNetworkDomains",
-    DeprecatedSandboxAllowedNetworkDomains = "chat.agent.sandbox.allowedNetworkDomains",
-    DeprecatedSandboxDeniedNetworkDomains = "chat.agent.sandbox.deniedNetworkDomains",
-    DeprecatedOldAllowedNetworkDomains = "chat.agent.sandboxNetwork.allowedDomains",
-    DeprecatedOldDeniedNetworkDomains = "chat.agent.sandboxNetwork.deniedDomains"
+    DeniedNetworkDomains = "chat.agent.deniedNetworkDomains"
 }

package/vscode/src/vs/platform/networkFilter/common/settings.js

@@ -5,10 +5,6 @@ var AgentNetworkDomainSettingId;
     AgentNetworkDomainSettingId["NetworkFilter"] = "chat.agent.networkFilter";
     AgentNetworkDomainSettingId["AllowedNetworkDomains"] = "chat.agent.allowedNetworkDomains";
     AgentNetworkDomainSettingId["DeniedNetworkDomains"] = "chat.agent.deniedNetworkDomains";
-    AgentNetworkDomainSettingId["DeprecatedSandboxAllowedNetworkDomains"] = "chat.agent.sandbox.allowedNetworkDomains";
-    AgentNetworkDomainSettingId["DeprecatedSandboxDeniedNetworkDomains"] = "chat.agent.sandbox.deniedNetworkDomains";
-    AgentNetworkDomainSettingId["DeprecatedOldAllowedNetworkDomains"] = "chat.agent.sandboxNetwork.allowedDomains";
-    AgentNetworkDomainSettingId["DeprecatedOldDeniedNetworkDomains"] = "chat.agent.sandboxNetwork.deniedDomains";
 })(AgentNetworkDomainSettingId || (AgentNetworkDomainSettingId = {}));
 
 export { AgentNetworkDomainSettingId };

package/vscode/src/vs/platform/sandbox/common/terminalSandboxEngine.d.ts

@@ -4,13 +4,25 @@ import { OperatingSystem } from "@codingame/monaco-vscode-api/vscode/vs/base/com
 import { URI } from "@codingame/monaco-vscode-api/vscode/vs/base/common/uri";
 import { IFileService } from "@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service";
 import { ILogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service";
+import { AgentNetworkDomainSettingId } from "../../networkFilter/common/settings.js";
 import { ISandboxDependencyStatus, type IWindowsMxcConfig, IWindowsMxcFilesystemPolicy, type IWindowsMxcPolicyContainment, type IWindowsMxcSandboxPolicy } from "@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/sandboxHelperService";
+import { AgentSandboxSettingId } from "@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings";
 import { IWindowsMxcTerminalSandboxRuntime } from "@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service";
 import { ITerminalSandboxCommand, ITerminalSandboxFileAccessCheckResult, ITerminalSandboxPrecheckInputs, ITerminalSandboxPrerequisiteCheckResult, ITerminalSandboxResolvedNetworkDomains, ITerminalSandboxWrapResult, TerminalSandboxFileAccessPermission } from "./terminalSandboxService.js";
 /** Runtime information needed to launch the sandbox-runtime CLI. */
 export interface ITerminalSandboxRuntimeInfo {
     /** Directory that contains `node_modules/@vscode/sandbox-runtime` and `node_modules/@vscode/ripgrep`. */
     appRoot: string;
+    /**
+     * Name of the directory (relative to {@link appRoot}) that holds the native
+     * binaries `ripgrep-universal` and `@microsoft/mxc-sdk`. In a packaged desktop
+     * build these are unpacked from the archive into `node_modules.asar.unpacked`;
+     * in dev and on remote they live in plain `node_modules`. Defaults to
+     * `node_modules`. Note the sandbox-runtime CLI itself is always resolved from
+     * plain `node_modules` (it is duplicated out of the archive) because it is
+     * spawned as a standalone Node subprocess without the ASAR resolution hook.
+     */
+    nativeModulesDir?: string;
     /** Path of the node/electron executable used to run sandbox-runtime. */
     execPath?: string;
     /**
@@ -45,9 +57,11 @@ export interface ITerminalSandboxEngineHost {
     getSandboxTempDir(): Promise<URI | undefined>;
     /** Path added to `allowRead` and `allowWrite` for the engine's workspace/session storage area. */
     getWorkspaceStorageReadRoot(): Promise<URI | undefined>;
+    /** Additional paths that hosts require sandboxed commands to read. */
+    getReadRoots?(): readonly URI[];
     /** Roots that must be writable inside the sandbox (workspace folders / session cwds). */
     getWriteRoots(): readonly URI[];
-    /** Fires when {@link getWriteRoots} or {@link getWorkspaceStorageReadRoot} change. */
+    /** Fires when host read roots, write roots, or workspace storage roots change. */
     readonly onDidChangeRoots: Event<void>;
     /** Resolves the installed sandbox-dependency status (bubblewrap, socat). */
     checkSandboxDependencies(): Promise<ISandboxDependencyStatus | undefined>;
@@ -59,11 +73,9 @@ export interface ITerminalSandboxEngineHost {
     buildWindowsMxcSandboxPayload(commandLine: string, policy: IWindowsMxcSandboxPolicy, workingDirectory?: string, containerName?: string, containment?: IWindowsMxcPolicyContainment): Promise<IWindowsMxcConfig | undefined>;
     /**
      * Returns the effective value of a sandbox-related configuration setting,
-     * or `undefined` when the setting is not configured. Implementations are
-     * responsible for mapping deprecated keys to modern ones (the engine
-     * only ever asks for the modern setting IDs).
+     * or `undefined` when the setting is not configured.
      */
-    getSandboxSetting<T>(settingId: string): T | undefined;
+    getSandboxSetting<T>(settingId: AgentSandboxSettingId | AgentNetworkDomainSettingId): T | undefined;
     /**
      * Fires when any value returned by {@link getSandboxSetting} may have
      * changed. The engine invalidates its sandbox-config file on each event.
@@ -102,6 +114,8 @@ export declare class TerminalSandboxEngine extends Disposable {
     private _windowsMxcEnvironment;
     private _sandboxConfigPath;
     private _sandboxDependencyStatus;
+    private _enableWeakerNestedSandbox;
+    private _apparmorRemediationRequested;
     private _needsForceUpdateConfigFile;
     private _tempDir;
     private _commandAllowListKeywords;
@@ -223,9 +237,7 @@ export declare class TerminalSandboxEngine extends Disposable {
     private _getDefaultWindowsMxcCwd;
     private _getSandboxConfiguredEnabledValue;
     private _getSandboxConfiguredWindowsEnabledValue;
-    private _normalizeSandboxEnabledValue;
     private _isSandboxAllowNetworkConfigured;
     private _areUnsandboxedCommandsAllowed;
     private _areRetryWithAllowNetworkRequestsAllowed;
-    private _getSettingValue;
 }

package/vscode/src/vs/platform/sandbox/common/terminalSandboxEngine.js

@@ -14,7 +14,7 @@ import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/fi
 import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
 import { matchesDomainPattern, normalizeDomain } from '../../networkFilter/common/domainMatcher.js';
 import { AgentNetworkDomainSettingId } from '../../networkFilter/common/settings.js';
-import { isAgentSandboxEnabledValue, AgentSandboxSettingId, AgentSandboxEnabledValue, normalizeAgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
+import { isAgentSandboxEnabledValue, AgentSandboxSettingId, AgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
 import { IWindowsMxcTerminalSandboxRuntime } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/terminalSandboxMxcRuntime.service';
 import { getTerminalSandboxReadAllowListForCommands } from './terminalSandboxReadAllowList.js';
 import { getTerminalSandboxRuntimeConfigurationForCommands } from './terminalSandboxRuntimeConfigurationPerOperation.js';
@@ -43,6 +43,8 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         this._sandboxSettingsId = generateUuid();
         this._runtimeResolved = false;
         this._runAsNode = false;
+        this._enableWeakerNestedSandbox = false;
+        this._apparmorRemediationRequested = false;
         this._needsForceUpdateConfigFile = true;
         this._commandAllowListKeywords = [];
         this._commandAllowListCommandDetails = [];
@@ -88,8 +90,8 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         this._needsForceUpdateConfigFile = true;
     }
     getResolvedNetworkDomains() {
-        const allowedDomains = this._getSettingValue(AgentNetworkDomainSettingId.AllowedNetworkDomains) ?? [];
-        const deniedDomains = this._getSettingValue(AgentNetworkDomainSettingId.DeniedNetworkDomains) ?? [];
+        const allowedDomains = this._host.getSandboxSetting(AgentNetworkDomainSettingId.AllowedNetworkDomains) ?? [];
+        const deniedDomains = this._host.getSandboxSetting(AgentNetworkDomainSettingId.DeniedNetworkDomains) ?? [];
         return {
             allowedDomains,
             deniedDomains
@@ -137,7 +139,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         }
         if (!requestUnsandboxedExecution && !retryWithAllowNetworkRequests && allowUnsandboxedCommands && blockedDomainResult.blockedDomains.length > 0) {
             return {
-                command: this._wrapUnsandboxedCommand(command, shell),
+                command: this._wrapUnsandboxedCommand(command, shell, cwd),
                 isSandboxWrapped: false,
                 blockedDomains: blockedDomainResult.blockedDomains,
                 deniedDomains: blockedDomainResult.deniedDomains,
@@ -146,7 +148,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         }
         if (requestUnsandboxedExecution && allowUnsandboxedCommands) {
             return {
-                command: this._wrapUnsandboxedCommand(command, shell),
+                command: this._wrapUnsandboxedCommand(command, shell, cwd),
                 isSandboxWrapped: false
             };
         }
@@ -210,7 +212,19 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         }
         if (!(await this._checkSandboxDependencies(forceRefresh))) {
             const missingDependencies = await this.getMissingSandboxDependencies();
-            if (missingDependencies.length === 0 && this._sandboxDependencyStatus?.bubblewrapInstalled && !this._sandboxDependencyStatus.bubblewrapUsable) {
+            if (missingDependencies.length === 0 && this._sandboxDependencyStatus?.bubblewrapUsable === false) {
+                if (this._sandboxDependencyStatus.apparmorRestrictsUnprivilegedUserNamespaces !== true || (forceRefresh && this._apparmorRemediationRequested)) {
+                    if (!this._enableWeakerNestedSandbox) {
+                        this._enableWeakerNestedSandbox = true;
+                        await this.getSandboxConfigPath(true, precheckInputs);
+                    }
+                    return {
+                        enabled: true,
+                        sandboxConfigPath: this._sandboxConfigPath,
+                        failedCheck: undefined
+                    };
+                }
+                this._apparmorRemediationRequested = true;
                 return {
                     enabled: true,
                     sandboxConfigPath,
@@ -223,7 +237,8 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
                 enabled: true,
                 sandboxConfigPath,
                 failedCheck: TerminalSandboxPrerequisiteCheck.Dependencies,
-                missingDependencies
+                missingDependencies,
+                canInstallMissingDependencies: !!this._sandboxDependencyStatus?.dependencyInstallCommand
             };
         }
         return {
@@ -340,17 +355,18 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         const tempDirPath = this._tempDir?.path;
         return this._os === OperatingSystem.Linux && cwd?.path && tempDirPath && cwd.path !== tempDirPath ? `cd ${this._quoteShellArgument(tempDirPath)}; ${sandboxRuntimeCommand}` : sandboxRuntimeCommand;
     }
-    _wrapUnsandboxedCommand(command, shell) {
+    _wrapUnsandboxedCommand(command, shell, cwd) {
         if (this._os === OperatingSystem.Windows) {
             return this._windowsMxcRuntime.wrapUnsandboxedCommand(command);
         }
         if (!this._tempDir?.path) {
             return command;
         }
+        const commandWithPreservedCwd = this._getSandboxCommandWithPreservedCwd(command, cwd);
         if (!shell) {
-            return `(TMPDIR="${this._tempDir.path}"; export TMPDIR; ${command})`;
+            return `(TMPDIR="${this._tempDir.path}"; export TMPDIR; ${commandWithPreservedCwd})`;
         }
-        return `env TMPDIR="${this._tempDir.path}" ${this._quoteShellArgument(shell)} -c ${this._quoteShellArgument(command)}`;
+        return `env TMPDIR="${this._tempDir.path}" ${this._quoteShellArgument(shell)} -c ${this._quoteShellArgument(commandWithPreservedCwd)}`;
     }
     _getBlockedDomains(command) {
         if (this._isSandboxAllowNetworkConfigured()) {
@@ -481,18 +497,19 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             "dist",
             "cli.js"
         );
+        const nativeModulesDir = runtimeInfo.nativeModulesDir ?? "node_modules";
         const rgPlatform = this._os === OperatingSystem.Windows ? "win32" : this._os === OperatingSystem.Macintosh ? "darwin" : "linux";
         const rgBinary = this._os === OperatingSystem.Windows ? "rg.exe" : "rg";
         this._rgPath = this._pathJoin(
             this._appRoot,
-            "node_modules",
+            nativeModulesDir,
             "@vscode",
             "ripgrep-universal",
             "bin",
             `${rgPlatform}-${arch}`,
             rgBinary
         );
-        this._mxcPath = this._windowsMxcRuntime.getExecutablePath(this._appRoot, runtimeInfo.arch);
+        this._mxcPath = this._windowsMxcRuntime.getExecutablePath(this._appRoot, nativeModulesDir, runtimeInfo.arch);
     }
     async _createSandboxConfig() {
         if ((await this.isEnabled()) && !this._tempDir) {
@@ -502,11 +519,16 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             return undefined;
         }
         const allowNetwork = this._commandAllowNetwork || (await this.isSandboxAllowNetworkEnabled());
-        const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {} : {};
-        const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {} : {};
-        const windowsFileSystemSetting = this._os === OperatingSystem.Windows ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {} : {};
-        const windowsSchemaVersion = this._os === OperatingSystem.Windows ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsSchemaVersion) : undefined;
-        const runtimeSetting = this._getSettingValue(AgentSandboxSettingId.AgentSandboxAdvancedRuntime) ?? {};
+        const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {} : {};
+        const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {} : {};
+        const windowsFileSystemSetting = this._os === OperatingSystem.Windows ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {} : {};
+        const windowsSchemaVersion = this._os === OperatingSystem.Windows ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxWindowsSchemaVersion) : undefined;
+        const runtimeSetting = {
+            ...this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxAdvancedRuntime),
+            ...(this._enableWeakerNestedSandbox ? {
+                enableWeakerNestedSandbox: true
+            } : undefined)
+        };
         const commandRuntimeSetting = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
         const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowRead");
         const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowWrite");
@@ -599,9 +621,9 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         return this._sandboxConfigPath;
     }
     async _getFileSystemAccessPaths(configFilePath) {
-        const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {} : {};
-        const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {} : {};
-        const windowsFileSystemSetting = this._os === OperatingSystem.Windows ? this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {} : {};
+        const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxLinuxFileSystem) ?? {} : {};
+        const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxMacFileSystem) ?? {} : {};
+        const windowsFileSystemSetting = this._os === OperatingSystem.Windows ? this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxWindowsFileSystem) ?? {} : {};
         const commandRuntimeSetting = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
         const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowRead");
         const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowWrite");
@@ -794,6 +816,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         return [...( new Set([...(configuredDenyRead ?? []), ...(userHome ? [userHome] : [])]))];
     }
     async _updateAllowReadPathsWithAllowWrite(configuredAllowRead, allowWrite, commandRuntimeAllowRead = []) {
+        const hostReadPaths = this._host.getReadRoots?.().map(root => this._getUriPath(root)) ?? [];
         return [...( new Set([
             ...(configuredAllowRead ?? []),
             ...getTerminalSandboxReadAllowListForCommands(
@@ -804,6 +827,7 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
             ...commandRuntimeAllowRead,
             ...this._getSandboxRuntimeReadPaths(),
             ...(await this._getWorkspaceStorageReadPaths()),
+            ...hostReadPaths,
             ...allowWrite
         ]))];
     }
@@ -930,31 +954,19 @@ let TerminalSandboxEngine = class TerminalSandboxEngine extends Disposable {
         return this._host.getWriteRoots()[0];
     }
     _getSandboxConfiguredEnabledValue() {
-        return this._normalizeSandboxEnabledValue(this._getSettingValue(AgentSandboxSettingId.AgentSandboxEnabled));
+        return this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxEnabled) ?? AgentSandboxEnabledValue.Off;
     }
     _getSandboxConfiguredWindowsEnabledValue() {
-        return this._normalizeSandboxEnabledValue(this._getSettingValue(AgentSandboxSettingId.AgentSandboxWindowsEnabled));
-    }
-    _normalizeSandboxEnabledValue(value) {
-        return value === undefined ? AgentSandboxEnabledValue.Off : normalizeAgentSandboxEnabledValue(value);
+        return this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxWindowsEnabled) ?? AgentSandboxEnabledValue.Off;
     }
     _isSandboxAllowNetworkConfigured() {
-        if (this._getSettingValue(AgentSandboxSettingId.AgentSandboxAllowNetwork) === true) {
-            return true;
-        }
-        if (this._os === OperatingSystem.Windows) {
-            return this._getSandboxConfiguredWindowsEnabledValue() === AgentSandboxEnabledValue.AllowNetwork;
-        }
-        return this._getSandboxConfiguredEnabledValue() === AgentSandboxEnabledValue.AllowNetwork;
+        return this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxAllowNetwork) === true;
     }
     _areUnsandboxedCommandsAllowed() {
-        return this._getSettingValue(AgentSandboxSettingId.AgentSandboxAllowUnsandboxedCommands) === true;
+        return this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxAllowUnsandboxedCommands) === true;
     }
     _areRetryWithAllowNetworkRequestsAllowed() {
-        return this._getSettingValue(AgentSandboxSettingId.AgentSandboxRetryWithAllowNetworkRequests) === true;
-    }
-    _getSettingValue(settingId) {
-        return this._host.getSandboxSetting(settingId);
+        return this._host.getSandboxSetting(AgentSandboxSettingId.AgentSandboxRetryWithAllowNetworkRequests) === true;
     }
 };
 TerminalSandboxEngine = TerminalSandboxEngine_1 = ( __decorate([( __param(1, IFileService)), ( __param(2, ILogService)), ( __param(3, IWindowsMxcTerminalSandboxRuntime))], TerminalSandboxEngine));

package/vscode/src/vs/platform/sandbox/common/terminalSandboxReadAllowList.d.ts

@@ -13,6 +13,7 @@ export declare enum TerminalSandboxReadAllowListOperation {
     Ruby = "ruby",
     NativeBuild = "nativeBuild",
     Conan = "conan",
-    GnuPG = "gnupg"
+    GnuPG = "gnupg",
+    Ssh = "ssh"
 }
 export declare function getTerminalSandboxReadAllowListForCommands(os: OperatingSystem, commandKeywords: readonly string[], commandDetails?: readonly ITerminalSandboxCommand[]): readonly string[];

package/vscode/src/vs/platform/sandbox/common/terminalSandboxReadAllowList.js

@@ -17,12 +17,14 @@ var TerminalSandboxReadAllowListOperation;
     TerminalSandboxReadAllowListOperation["NativeBuild"] = "nativeBuild";
     TerminalSandboxReadAllowListOperation["Conan"] = "conan";
     TerminalSandboxReadAllowListOperation["GnuPG"] = "gnupg";
+    TerminalSandboxReadAllowListOperation["Ssh"] = "ssh";
 })(
     TerminalSandboxReadAllowListOperation || (TerminalSandboxReadAllowListOperation = {})
 );
 const terminalSandboxReadAllowListKeywordMap = ( new Map([
     ["git", TerminalSandboxReadAllowListOperation.Git],
     ["gh", TerminalSandboxReadAllowListOperation.Git],
+    ["gpg", TerminalSandboxReadAllowListOperation.GnuPG],
     ["node", TerminalSandboxReadAllowListOperation.Node],
     ["npm", TerminalSandboxReadAllowListOperation.Node],
     ["npx", TerminalSandboxReadAllowListOperation.Node],
@@ -260,6 +262,13 @@ function getTerminalSandboxReadAllowListForOperation(operation, os) {
         default:
             return ["~/.gnupg"];
         }
+    case TerminalSandboxReadAllowListOperation.Ssh:
+        switch (os) {
+        case OperatingSystem.Macintosh:
+        case OperatingSystem.Linux:
+        default:
+            return ["~/.ssh"];
+        }
     }
 }
 function getTerminalSandboxReadAllowListForCommandDetails(os, commandDetails) {
@@ -282,6 +291,9 @@ const terminalSandboxReadAllowListCommandDetailRules = [{
 }, {
     keywords: ["git"],
     value: TerminalSandboxReadAllowListOperation.GnuPG
+}, {
+    keywords: ["git", "ssh", "scp", "sftp", "rsync"],
+    value: TerminalSandboxReadAllowListOperation.Ssh
 }];
 function getTerminalSandboxReadAllowListForCommands(os, commandKeywords, commandDetails = []) {
     if (commandKeywords.length === 0) {

package/vscode/src/vs/platform/sandbox/common/terminalSandboxRuntimeConfigurationPerOperation.js

@@ -35,7 +35,6 @@ const terminalSandboxRuntimeConfigurationCommandRules = [{
         }
     ) => os !== OperatingSystem.Windows
 }];
-const terminalSandboxGnuPGCompatibleCommandKeywords = ( new Set(["git", "gh", "gpg", "gpg2"]));
 function getTerminalSandboxRuntimeConfigurationForOperation(operation, os) {
     switch (operation) {
     case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
@@ -93,7 +92,7 @@ function getTerminalSandboxRuntimeConfigurationForCommands(os, commandDetails) {
 function shouldApplyRuntimeConfigurationOperation(operation, commandDetails) {
     switch (operation) {
     case TerminalSandboxRuntimeConfigurationOperation.GnuPG:
-        return commandDetails.every(command => ( terminalSandboxGnuPGCompatibleCommandKeywords.has(command.keyword.toLowerCase())));
+        return commandDetails.every(command => !command.keyword.toLowerCase().startsWith("docker"));
     case TerminalSandboxRuntimeConfigurationOperation.Node:
         return true;
     }

package/vscode/src/vs/platform/sandbox/common/terminalSandboxService.d.ts

@@ -20,6 +20,7 @@ export interface ITerminalSandboxPrerequisiteCheckResult {
     sandboxConfigPath: string | undefined;
     failedCheck: TerminalSandboxPrerequisiteCheck | undefined;
     missingDependencies?: string[];
+    canInstallMissingDependencies?: boolean;
     remediations?: readonly TerminalSandboxPreCheckRemediation[];
     detail?: string;
 }

package/vscode/src/vs/platform/terminal/common/autoApprove/autoApproveParseSafety.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns whether a tree-sitter parse error should prevent auto-approval.
+ * The command can still run after the user confirms it.
+ */
+export declare function shouldRequireConfirmationForAutoApproveParse(language: "bash" | "powershell", hasError: boolean): boolean;

package/vscode/src/vs/platform/terminal/common/autoApprove/autoApproveParseSafety.js

@@ -0,0 +1,7 @@
+
+
+function shouldRequireConfirmationForAutoApproveParse(language, hasError) {
+    return language === 'powershell' && hasError;
+}
+
+export { shouldRequireConfirmationForAutoApproveParse };

package/vscode/src/vs/platform/terminal/common/autoApprove/cmdDelayedExpansion.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns whether the text contains balanced CMD delayed environment-variable
+ * expansion syntax, such as `!APPDATA!` or `!VAR:~0,1!`.
+ */
+export declare function containsCmdDelayedExpansion(value: string): boolean;

package/vscode/src/vs/platform/terminal/common/autoApprove/cmdDelayedExpansion.js

@@ -0,0 +1,8 @@
+
+
+const cmdDelayedExpansionRegex = /![^!\r\n]+!/;
+function containsCmdDelayedExpansion(value) {
+    return cmdDelayedExpansionRegex.test(value);
+}
+
+export { containsCmdDelayedExpansion };