@codingame/monaco-vscode-katex-common 30.0.1 → 31.0.0

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.js

@@ -0,0 +1,608 @@
+
+import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
+import { timeout } from '@codingame/monaco-vscode-api/vscode/vs/base/common/async';
+import { VSBuffer } from '@codingame/monaco-vscode-api/vscode/vs/base/common/buffer';
+import { Event } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
+import { Disposable, DisposableStore } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
+import { FileAccess } from '@codingame/monaco-vscode-api/vscode/vs/base/common/network';
+import { win32, posix, dirname } from '@codingame/monaco-vscode-api/vscode/vs/base/common/path';
+import { OS, OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
+import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
+import { generateUuid } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uuid';
+import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
+import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
+import { IEnvironmentService } from '@codingame/monaco-vscode-api/vscode/vs/platform/environment/common/environment.service';
+import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service';
+import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
+import { IRemoteAgentService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/remote/common/remoteAgentService.service';
+import { TerminalChatAgentToolsSettingId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration';
+import { AgentNetworkDomainSettingId } from '../../../../../platform/networkFilter/common/settings.js';
+import { matchesDomainPattern, normalizeDomain } from '../../../../../platform/networkFilter/common/domainMatcher.js';
+import { IWorkspaceContextService } from '@codingame/monaco-vscode-api/vscode/vs/platform/workspace/common/workspace.service';
+import { IProductService } from '@codingame/monaco-vscode-api/vscode/vs/platform/product/common/productService.service';
+import { WillShutdownJoinerOrder } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/lifecycle/common/lifecycle';
+import { ILifecycleService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/lifecycle/common/lifecycle.service';
+import { ISandboxHelperService } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/sandboxHelperService.service';
+import { TerminalCapability } from '@codingame/monaco-vscode-api/vscode/vs/platform/terminal/common/capabilities/capabilities';
+import { MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
+import { ChatElicitationRequestPart } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/model/chatProgressTypes/chatElicitationRequestPart';
+import { ChatModel } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/model/chatModel';
+import { ElicitationState } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/chatService/chatService';
+import { IChatService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/chatService/chatService.service';
+import { SANDBOX_HELPER_CHANNEL_NAME, SandboxHelperChannelClient } from '../../../../../platform/sandbox/common/sandboxHelperIpc.js';
+import { AgentSandboxSettingId, AgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
+import { TerminalSandboxPrerequisiteCheck } from '../../../../../platform/sandbox/common/terminalSandboxService.js';
+import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
+
+var TerminalSandboxService_1;
+let TerminalSandboxService = class TerminalSandboxService extends Disposable {
+    static {
+        TerminalSandboxService_1 = this;
+    }
+    static {
+        this._sandboxTempDirName = "tmp";
+    }
+    static {
+        this._urlRegex = /(?:https?|wss?):\/\/[^\s'"`|&;<>]+/gi;
+    }
+    static {
+        this._sshRemoteRegex = /(?:^|[\s'"`])(?:[^\s@:'"`]+@)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(?::[^\s'"`|&;<>]+)(?=$|[\s'"`|&;<>])/gi;
+    }
+    static {
+        this._hostRegex = /(?:^|[\s'"`(=])([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(?::\d+)?(?=(?:\/[^\s'"`|&;<>]*)?(?:$|[\s'"`)\]|,;|&<>]))/gi;
+    }
+    constructor(
+        _configurationService,
+        _fileService,
+        _environmentService,
+        _logService,
+        _remoteAgentService,
+        _workspaceContextService,
+        _productService,
+        _lifecycleService,
+        _sandboxHelperService,
+        _chatService
+    ) {
+        super();
+        this._configurationService = _configurationService;
+        this._fileService = _fileService;
+        this._environmentService = _environmentService;
+        this._logService = _logService;
+        this._remoteAgentService = _remoteAgentService;
+        this._workspaceContextService = _workspaceContextService;
+        this._productService = _productService;
+        this._lifecycleService = _lifecycleService;
+        this._sandboxHelperService = _sandboxHelperService;
+        this._chatService = _chatService;
+        this._srtPathResolved = false;
+        this._needsForceUpdateConfigFile = true;
+        this._remoteEnvDetails = null;
+        this._os = OS;
+        this._defaultWritePaths = ["~/.npm"];
+        this._pathJoin = (...segments) => {
+            const path = this._os === OperatingSystem.Windows ? win32 : posix;
+            return path.join(...segments);
+        };
+        this._appRoot = dirname(( FileAccess.asFileUri("")).path);
+        const nativeEnv = this._environmentService;
+        this._execPath = nativeEnv.execPath;
+        this._sandboxSettingsId = generateUuid();
+        this._remoteEnvDetailsPromise = this._remoteAgentService.getEnvironment();
+        this._register(
+            Event.runAndSubscribe(this._configurationService.onDidChangeConfiguration, e => {
+                if (e?.affectsConfiguration(AgentSandboxSettingId.AgentSandboxEnabled) || e?.affectsConfiguration(AgentSandboxSettingId.DeprecatedAgentSandboxEnabled) || e?.affectsConfiguration(AgentNetworkDomainSettingId.AllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedSandboxAllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedOldAllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeniedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedSandboxDeniedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedOldDeniedNetworkDomains) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxLinuxFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxLinuxFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxMacFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxMacFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxAdvancedRuntime)) {
+                    this.setNeedsForceUpdateConfigFile();
+                }
+            })
+        );
+        this._register(this._workspaceContextService.onDidChangeWorkspaceFolders(() => {
+            this.setNeedsForceUpdateConfigFile();
+        }));
+        this._register(this._lifecycleService.onWillShutdown(e => {
+            if (!this._tempDir) {
+                return;
+            }
+            e.join(this._cleanupSandboxTempDir(), {
+                id: "join.deleteFilesInSandboxTempDir",
+                label: ( localize(14190, "Delete Files in Sandbox Temp Dir")),
+                order: WillShutdownJoinerOrder.Default
+            });
+        }));
+    }
+    async isEnabled() {
+        return await this._isSandboxConfiguredEnabled();
+    }
+    async getOS() {
+        this._remoteEnvDetails = await this._remoteEnvDetailsPromise;
+        this._os = this._remoteEnvDetails ? this._remoteEnvDetails.os : OS;
+        return this._os;
+    }
+    wrapCommand(command, requestUnsandboxedExecution, shell) {
+        if (!this._sandboxConfigPath || !this._tempDir) {
+            throw ( new Error("Sandbox config path or temp dir not initialized"));
+        }
+        const blockedDomainResult = requestUnsandboxedExecution ? {
+            blockedDomains: [],
+            deniedDomains: []
+        } : this._getBlockedDomains(command);
+        if (!requestUnsandboxedExecution && blockedDomainResult.blockedDomains.length > 0) {
+            return {
+                command: this._wrapUnsandboxedCommand(command, shell),
+                isSandboxWrapped: false,
+                blockedDomains: blockedDomainResult.blockedDomains,
+                deniedDomains: blockedDomainResult.deniedDomains,
+                requiresUnsandboxConfirmation: true
+            };
+        }
+        if (requestUnsandboxedExecution) {
+            return {
+                command: this._wrapUnsandboxedCommand(command, shell),
+                isSandboxWrapped: false
+            };
+        }
+        if (!this._execPath) {
+            throw ( new Error("Executable path not set to run sandbox commands"));
+        }
+        if (!this._srtPath) {
+            throw ( new Error("Sandbox runtime path not resolved"));
+        }
+        if (!this._rgPath) {
+            throw ( new Error("Ripgrep path not resolved"));
+        }
+        const wrappedCommand = `PATH="$PATH:${dirname(this._rgPath)}" TMPDIR="${this._tempDir.path}" CLAUDE_TMPDIR="${this._tempDir.path}" "${this._execPath}" "${this._srtPath}" --settings "${this._sandboxConfigPath}" -c ${this._quoteShellArgument(command)}`;
+        if (this._remoteEnvDetails) {
+            return {
+                command: wrappedCommand,
+                isSandboxWrapped: true
+            };
+        }
+        return {
+            command: `ELECTRON_RUN_AS_NODE=1 ${wrappedCommand}`,
+            isSandboxWrapped: true
+        };
+    }
+    getTempDir() {
+        return this._tempDir;
+    }
+    setNeedsForceUpdateConfigFile() {
+        this._needsForceUpdateConfigFile = true;
+    }
+    async checkForSandboxingPrereqs(forceRefresh = false) {
+        if (!(await this._isSandboxConfiguredEnabled())) {
+            return {
+                enabled: false,
+                sandboxConfigPath: undefined,
+                failedCheck: undefined
+            };
+        }
+        const sandboxConfigPath = await this.getSandboxConfigPath(forceRefresh);
+        if (!sandboxConfigPath) {
+            return {
+                enabled: true,
+                sandboxConfigPath,
+                failedCheck: TerminalSandboxPrerequisiteCheck.Config
+            };
+        }
+        if (!(await this._checkSandboxDependencies(forceRefresh))) {
+            return {
+                enabled: true,
+                sandboxConfigPath,
+                failedCheck: TerminalSandboxPrerequisiteCheck.Dependencies,
+                missingDependencies: await this.getMissingSandboxDependencies()
+            };
+        }
+        return {
+            enabled: true,
+            sandboxConfigPath,
+            failedCheck: undefined
+        };
+    }
+    async getSandboxConfigPath(forceRefresh = false) {
+        if (!(await this._isSandboxConfiguredEnabled())) {
+            return undefined;
+        }
+        await this._resolveSrtPath();
+        if (!this._sandboxConfigPath || forceRefresh || this._needsForceUpdateConfigFile) {
+            this._sandboxConfigPath = await this._createSandboxConfig();
+            this._needsForceUpdateConfigFile = false;
+        }
+        return this._sandboxConfigPath;
+    }
+    async _checkSandboxDependencies(forceRefresh = false) {
+        const os = await this.getOS();
+        if (os === OperatingSystem.Windows) {
+            return false;
+        }
+        const sandboxDependencyStatus = await this._resolveSandboxDependencyStatus(forceRefresh);
+        this._sandboxDependencyStatus = sandboxDependencyStatus;
+        if (sandboxDependencyStatus && !sandboxDependencyStatus.bubblewrapInstalled) {
+            this._logService.warn("TerminalSandboxService: bubblewrap (bwrap) is not installed");
+        }
+        if (sandboxDependencyStatus && !sandboxDependencyStatus.socatInstalled) {
+            this._logService.warn("TerminalSandboxService: socat is not installed");
+        }
+        return sandboxDependencyStatus ? sandboxDependencyStatus.bubblewrapInstalled && sandboxDependencyStatus.socatInstalled : true;
+    }
+    async getMissingSandboxDependencies() {
+        const os = await this.getOS();
+        if (os === OperatingSystem.Windows) {
+            return [];
+        }
+        if (!this._sandboxDependencyStatus || !this._sandboxDependencyStatus.bubblewrapInstalled || !this._sandboxDependencyStatus.socatInstalled) {
+            this._sandboxDependencyStatus = await this._resolveSandboxDependencyStatus(true);
+        }
+        const missing = [];
+        if (this._sandboxDependencyStatus && !this._sandboxDependencyStatus.bubblewrapInstalled) {
+            missing.push("bubblewrap");
+        }
+        if (this._sandboxDependencyStatus && !this._sandboxDependencyStatus.socatInstalled) {
+            missing.push("socat");
+        }
+        return missing;
+    }
+    async installMissingSandboxDependencies(missingDependencies, sessionResource, token, options) {
+        const depsList = missingDependencies.join(" ");
+        const installCommand = `sudo apt install -y ${depsList}`;
+        const instance = await options.createTerminal();
+        let installCommandSent = false;
+        const completionPromise = ( new Promise(resolve => {
+            const store = ( new DisposableStore());
+            let resolved = false;
+            const resolveOnce = code => {
+                if (resolved) {
+                    return;
+                }
+                resolved = true;
+                store.dispose();
+                resolve(code);
+            };
+            const attachListener = () => {
+                const detection = instance.capabilities.get(TerminalCapability.CommandDetection);
+                if (detection) {
+                    store.add(detection.onCommandFinished(cmd => resolveOnce(cmd.exitCode)));
+                }
+            };
+            attachListener();
+            store.add(instance.capabilities.onDidAddCapability(e => {
+                if (e.id === TerminalCapability.CommandDetection) {
+                    attachListener();
+                }
+            }));
+            store.add(instance.onDisposed(() => resolveOnce(undefined)));
+            store.add(token.onCancellationRequested(() => resolveOnce(undefined)));
+            const safetyTimeout = timeout(5 * 60 * 1000);
+            store.add({
+                dispose: () => safetyTimeout.cancel()
+            });
+            safetyTimeout.then(() => resolveOnce(undefined));
+            const passwordPrompt = this._createMissingDependencyPasswordPrompt(sessionResource, {
+                focusTerminal: () => options.focusTerminal(instance),
+                onDidInputData: instance.onDidInputData,
+                onDisposed: instance.onDisposed,
+                didSendInstallCommand: () => installCommandSent
+            }, token);
+            store.add(passwordPrompt);
+        }));
+        await instance.sendText(installCommand, true);
+        installCommandSent = true;
+        return {
+            exitCode: await completionPromise
+        };
+    }
+    _createMissingDependencyPasswordPrompt(sessionResource, promptContext, token) {
+        const chatModel = sessionResource && this._chatService.getSession(sessionResource);
+        if (!(chatModel instanceof ChatModel)) {
+            return ( new DisposableStore());
+        }
+        const request = chatModel.getRequests().at(-1);
+        if (!request) {
+            return ( new DisposableStore());
+        }
+        const part = ( new ChatElicitationRequestPart(( localize(14191, "The terminal is awaiting input.")), ( new MarkdownString(( localize(
+            14192,
+            "Installing missing sandbox dependencies may prompt for your sudo password. Select Focus Terminal to type it in the terminal."
+        )))), "", ( localize(14193, "Focus Terminal")), undefined, async () => {
+            await promptContext.focusTerminal();
+            return ElicitationState.Pending;
+        }));
+        chatModel.acceptResponseProgress(request, part);
+        const store = ( new DisposableStore());
+        const disposePrompt = () => store.dispose();
+        store.add({
+            dispose: () => part.hide()
+        });
+        store.add(token.onCancellationRequested(disposePrompt));
+        store.add(promptContext.onDisposed(disposePrompt));
+        store.add(promptContext.onDidInputData(data => {
+            if (promptContext.didSendInstallCommand() && data.length > 0) {
+                disposePrompt();
+            }
+        }));
+        return store;
+    }
+    _quoteShellArgument(value) {
+        return `'${value.replace(/'/g, `'\\''`)}'`;
+    }
+    _wrapUnsandboxedCommand(command, shell) {
+        if (!this._tempDir?.path) {
+            return command;
+        }
+        if (!shell) {
+            return `(TMPDIR="${this._tempDir.path}"; export TMPDIR; ${command})`;
+        }
+        return `env TMPDIR="${this._tempDir.path}" ${this._quoteShellArgument(shell)} -c ${this._quoteShellArgument(command)}`;
+    }
+    _getBlockedDomains(command) {
+        const domains = this._extractDomains(command);
+        if (domains.length === 0) {
+            return {
+                blockedDomains: [],
+                deniedDomains: []
+            };
+        }
+        const {
+            allowedDomains,
+            deniedDomains
+        } = this.getResolvedNetworkDomains();
+        const blockedDomains = ( new Set());
+        const explicitlyDeniedDomains = ( new Set());
+        for (const domain of domains) {
+            if (( deniedDomains.some(pattern => matchesDomainPattern(domain, pattern)))) {
+                blockedDomains.add(domain);
+                explicitlyDeniedDomains.add(domain);
+                continue;
+            }
+            if (!( allowedDomains.some(pattern => matchesDomainPattern(domain, pattern)))) {
+                blockedDomains.add(domain);
+            }
+        }
+        return {
+            blockedDomains: [...blockedDomains],
+            deniedDomains: [...explicitlyDeniedDomains]
+        };
+    }
+    _extractDomains(command) {
+        const domains = ( new Set());
+        let match;
+        TerminalSandboxService_1._urlRegex.lastIndex = 0;
+        while ((match = TerminalSandboxService_1._urlRegex.exec(command)) !== null) {
+            const domain = this._extractDomainFromUrl(match[0]);
+            if (domain) {
+                domains.add(domain);
+            }
+        }
+        TerminalSandboxService_1._sshRemoteRegex.lastIndex = 0;
+        while ((match = TerminalSandboxService_1._sshRemoteRegex.exec(command)) !== null) {
+            const domain = normalizeDomain(match[1], true);
+            if (domain) {
+                domains.add(domain);
+            }
+        }
+        TerminalSandboxService_1._hostRegex.lastIndex = 0;
+        while ((match = TerminalSandboxService_1._hostRegex.exec(command)) !== null) {
+            const domain = normalizeDomain(match[1]);
+            if (domain) {
+                domains.add(domain);
+            }
+        }
+        return [...domains];
+    }
+    _extractDomainFromUrl(value) {
+        try {
+            const authority = ( URI.parse(value)).authority;
+            return normalizeDomain(authority, true);
+        } catch {
+            return undefined;
+        }
+    }
+    async _isSandboxConfiguredEnabled() {
+        const os = await this.getOS();
+        if (os === OperatingSystem.Windows) {
+            return false;
+        }
+        return this._isSandboxEnabled(this._getSettingValue(
+            AgentSandboxSettingId.AgentSandboxEnabled,
+            AgentSandboxSettingId.DeprecatedAgentSandboxEnabled
+        ) ?? AgentSandboxEnabledValue.Off);
+    }
+    async _resolveSrtPath() {
+        if (this._srtPathResolved) {
+            return;
+        }
+        this._srtPathResolved = true;
+        const remoteEnv = this._remoteEnvDetails || (await this._remoteEnvDetailsPromise);
+        if (remoteEnv) {
+            this._appRoot = remoteEnv.appRoot.path;
+            this._execPath = remoteEnv.execPath;
+        }
+        this._srtPath = this._pathJoin(
+            this._appRoot,
+            "node_modules",
+            "@anthropic-ai",
+            "sandbox-runtime",
+            "dist",
+            "cli.js"
+        );
+        this._rgPath = this._pathJoin(this._appRoot, "node_modules", "@vscode", "ripgrep", "bin", "rg");
+    }
+    async _createSandboxConfig() {
+        if ((await this.isEnabled()) && !this._tempDir) {
+            await this._initTempDir();
+        }
+        if (this._tempDir) {
+            const allowedDomainsSetting = this._getSettingValue(
+                AgentNetworkDomainSettingId.AllowedNetworkDomains,
+                AgentNetworkDomainSettingId.DeprecatedSandboxAllowedNetworkDomains,
+                AgentNetworkDomainSettingId.DeprecatedOldAllowedNetworkDomains
+            ) ?? [];
+            const deniedDomainsSetting = this._getSettingValue(
+                AgentNetworkDomainSettingId.DeniedNetworkDomains,
+                AgentNetworkDomainSettingId.DeprecatedSandboxDeniedNetworkDomains,
+                AgentNetworkDomainSettingId.DeprecatedOldDeniedNetworkDomains
+            ) ?? [];
+            const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._getSettingValue(
+                TerminalChatAgentToolsSettingId.AgentSandboxLinuxFileSystem,
+                TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxLinuxFileSystem
+            ) ?? {} : {};
+            const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._getSettingValue(
+                TerminalChatAgentToolsSettingId.AgentSandboxMacFileSystem,
+                TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxMacFileSystem
+            ) ?? {} : {};
+            const runtimeSetting = this._getSettingValue(TerminalChatAgentToolsSettingId.AgentSandboxAdvancedRuntime) ?? {};
+            const configFileUri = URI.joinPath(this._tempDir, `vscode-sandbox-settings-${this._sandboxSettingsId}.json`);
+            const linuxAllowWrite = this._updateAllowWritePathsWithWorkspaceFolders(linuxFileSystemSetting.allowWrite);
+            const macAllowWrite = this._updateAllowWritePathsWithWorkspaceFolders(macFileSystemSetting.allowWrite);
+            const sandboxSettings = {
+                network: {
+                    allowedDomains: allowedDomainsSetting,
+                    deniedDomains: deniedDomainsSetting
+                },
+                filesystem: {
+                    denyRead: this._os === OperatingSystem.Macintosh ? macFileSystemSetting.denyRead : linuxFileSystemSetting.denyRead,
+                    allowWrite: this._os === OperatingSystem.Macintosh ? macAllowWrite : linuxAllowWrite,
+                    denyWrite: this._os === OperatingSystem.Macintosh ? macFileSystemSetting.denyWrite : linuxFileSystemSetting.denyWrite
+                }
+            };
+            this._mergeAdditionalSandboxConfigProperties(sandboxSettings, runtimeSetting);
+            this._sandboxConfigPath = configFileUri.path;
+            await this._fileService.createFile(
+                configFileUri,
+                VSBuffer.fromString(JSON.stringify(sandboxSettings, null, "\t")),
+                {
+                    overwrite: true
+                }
+            );
+            return this._sandboxConfigPath;
+        }
+        return undefined;
+    }
+    _mergeAdditionalSandboxConfigProperties(target, additional) {
+        for (const [key, value] of Object.entries(additional)) {
+            if (!Object.prototype.hasOwnProperty.call(target, key)) {
+                target[key] = value;
+                continue;
+            }
+            const existingValue = target[key];
+            if (this._isObjectForSandboxConfigMerge(existingValue) && this._isObjectForSandboxConfigMerge(value)) {
+                this._mergeAdditionalSandboxConfigProperties(existingValue, value);
+            }
+        }
+    }
+    _isObjectForSandboxConfigMerge(value) {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    async _initTempDir() {
+        if (await this.isEnabled()) {
+            this._needsForceUpdateConfigFile = true;
+            const remoteEnv = this._remoteEnvDetails || (await this._remoteEnvDetailsPromise);
+            this._tempDir = this._getSandboxTempDirPath(remoteEnv);
+            if (this._tempDir) {
+                await this._fileService.createFolder(this._tempDir);
+                this._defaultWritePaths.push(this._tempDir.path);
+            }
+            if (!this._tempDir) {
+                this._logService.warn(
+                    "TerminalSandboxService: Cannot create sandbox settings file because no tmpDir is available in this environment"
+                );
+            }
+        }
+    }
+    async _cleanupSandboxTempDir() {
+        if (!this._tempDir) {
+            return;
+        }
+        try {
+            await this._fileService.del(this._tempDir, {
+                recursive: true,
+                useTrash: false
+            });
+        } catch (error) {
+            this._logService.warn("TerminalSandboxService: Failed to delete sandbox temp dir", error);
+        }
+    }
+    _getSandboxTempDirPath(remoteEnv) {
+        const sandboxTempDirName = this._getSandboxWindowTempDirName();
+        if (remoteEnv?.userHome) {
+            const sandboxRoot = URI.joinPath(
+                remoteEnv.userHome,
+                this._productService.serverDataFolderName ?? this._productService.dataFolderName,
+                TerminalSandboxService_1._sandboxTempDirName
+            );
+            return sandboxTempDirName ? URI.joinPath(sandboxRoot, sandboxTempDirName) : sandboxRoot;
+        }
+        const nativeEnv = this._environmentService;
+        if (nativeEnv.userHome) {
+            const sandboxRoot = URI.joinPath(
+                nativeEnv.userHome,
+                this._productService.dataFolderName,
+                TerminalSandboxService_1._sandboxTempDirName
+            );
+            return sandboxTempDirName ? URI.joinPath(sandboxRoot, sandboxTempDirName) : sandboxRoot;
+        }
+        return undefined;
+    }
+    _getSandboxWindowTempDirName() {
+        const workbenchEnv = this._environmentService;
+        const windowId = workbenchEnv.window?.id;
+        return typeof windowId === "number" ? `tmp_vscode_${windowId}` : undefined;
+    }
+    getResolvedNetworkDomains() {
+        const allowedDomains = this._getSettingValue(
+            AgentNetworkDomainSettingId.AllowedNetworkDomains,
+            AgentNetworkDomainSettingId.DeprecatedSandboxAllowedNetworkDomains,
+            AgentNetworkDomainSettingId.DeprecatedOldAllowedNetworkDomains
+        ) ?? [];
+        const deniedDomains = this._getSettingValue(
+            AgentNetworkDomainSettingId.DeniedNetworkDomains,
+            AgentNetworkDomainSettingId.DeprecatedSandboxDeniedNetworkDomains,
+            AgentNetworkDomainSettingId.DeprecatedOldDeniedNetworkDomains
+        ) ?? [];
+        return {
+            allowedDomains,
+            deniedDomains
+        };
+    }
+    _updateAllowWritePathsWithWorkspaceFolders(configuredAllowWrite) {
+        const workspaceFolderPaths = ( this._workspaceContextService.getWorkspace().folders.map(folder => folder.uri.path));
+        return [...( new Set([
+            ...workspaceFolderPaths,
+            ...this._defaultWritePaths,
+            ...(configuredAllowWrite ?? [])
+        ]))];
+    }
+    async _resolveSandboxDependencyStatus(forceRefresh = false) {
+        if (!forceRefresh && this._sandboxDependencyStatus) {
+            return this._sandboxDependencyStatus;
+        }
+        const connection = this._remoteAgentService.getConnection();
+        if (connection) {
+            return connection.withChannel(SANDBOX_HELPER_CHANNEL_NAME, channel => {
+                const sandboxHelper = ( new SandboxHelperChannelClient(channel));
+                return sandboxHelper.checkSandboxDependencies();
+            });
+        }
+        return this._sandboxHelperService.checkSandboxDependencies();
+    }
+    _isSandboxEnabled(value) {
+        return value === true || value === AgentSandboxEnabledValue.On;
+    }
+    _getSettingValue(settingId, ...deprecatedSettingIds) {
+        const setting = this._configurationService.inspect(settingId);
+        if (setting.userValue !== undefined) {
+            return setting.value;
+        }
+        for (const deprecatedId of deprecatedSettingIds) {
+            const deprecated = this._configurationService.inspect(deprecatedId);
+            if (deprecated.userValue !== undefined) {
+                this._logService.warn(
+                    `TerminalSandboxService: Using deprecated setting ${deprecatedId} because ${settingId} is not set. Please update your settings to use ${settingId} instead.`
+                );
+                return deprecated.value;
+            }
+        }
+        return setting.value;
+    }
+};
+TerminalSandboxService = TerminalSandboxService_1 = ( __decorate([( __param(0, IConfigurationService)), ( __param(1, IFileService)), ( __param(2, IEnvironmentService)), ( __param(3, ILogService)), ( __param(4, IRemoteAgentService)), ( __param(5, IWorkspaceContextService)), ( __param(6, IProductService)), ( __param(7, ILifecycleService)), ( __param(8, ISandboxHelperService)), ( __param(9, IChatService))], TerminalSandboxService));
+
+export { TerminalSandboxPrerequisiteCheck, TerminalSandboxService };

package/vscode/src/vs/workbench/contrib/chat/browser/chatSessions/searchableOptionPickerActionItem.d.ts

@@ -1,40 +0,0 @@
-import { IAction } from "@codingame/monaco-vscode-api/vscode/vs/base/common/actions";
-import { IActionWidgetService } from "@codingame/monaco-vscode-api/vscode/vs/platform/actionWidget/browser/actionWidget.service";
-import { IActionWidgetDropdownAction } from "../../../../../platform/actionWidget/browser/actionWidgetDropdown.js";
-import { IContextKeyService } from "@codingame/monaco-vscode-api/vscode/vs/platform/contextkey/common/contextkey.service";
-import { IKeybindingService } from "@codingame/monaco-vscode-api/vscode/vs/platform/keybinding/common/keybinding.service";
-import { IChatSessionProviderOptionGroup, IChatSessionProviderOptionItem } from "@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/chatSessionsService";
-import { IDisposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
-import { IQuickInputService } from "@codingame/monaco-vscode-api/vscode/vs/platform/quickinput/common/quickInput.service";
-import { ChatSessionPickerActionItem, IChatSessionPickerDelegate } from "./chatSessionPickerActionItem.js";
-import { ILogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service";
-import { ICommandService } from "@codingame/monaco-vscode-api/vscode/vs/platform/commands/common/commands.service";
-import { ITelemetryService } from "@codingame/monaco-vscode-api/vscode/vs/platform/telemetry/common/telemetry.service";
-import { IChatInputPickerOptions } from "../widget/input/chatInputPickerActionItem.js";
-/**
- * Action view item for searchable option groups with QuickPick.
- * Used when an option group has `searchable: true` (e.g., repository selection).
- * Shows an inline dropdown with items + "See more..." option that opens a searchable QuickPick.
- */
-export declare class SearchableOptionPickerActionItem extends ChatSessionPickerActionItem {
-    private readonly quickInputService;
-    private readonly logService;
-    private static readonly SEE_MORE_ID;
-    constructor(action: IAction, initialState: {
-        group: IChatSessionProviderOptionGroup;
-        item: IChatSessionProviderOptionItem | undefined;
-    }, delegate: IChatSessionPickerDelegate, pickerOptions: IChatInputPickerOptions | undefined, actionWidgetService: IActionWidgetService, contextKeyService: IContextKeyService, keybindingService: IKeybindingService, quickInputService: IQuickInputService, logService: ILogService, commandService: ICommandService, telemetryService: ITelemetryService);
-    protected getDropdownActions(): IActionWidgetDropdownAction[];
-    protected renderLabel(element: HTMLElement): IDisposable | null;
-    protected getContainerClass(): string;
-    /**
-     * Shows the full searchable QuickPick with all items (initial + search results)
-     * Called when user clicks "See more..." from the dropdown
-     */
-    private showSearchableQuickPick;
-    private createQuickPickItem;
-    /**
-     * Opens the picker programmatically.
-     */
-    show(): void;
-}