@codingame/monaco-vscode-katex-common 31.0.0 → 32.0.0

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/runInTerminalTool.js

@@ -18,10 +18,12 @@ import { isNumber, isString } from '@codingame/monaco-vscode-api/vscode/vs/base/
 import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
 import { generateUuid } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uuid';
 import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
+import { ConfirmationOptionKind } from '@codingame/monaco-vscode-api/vscode/vs/platform/agentHost/common/state/protocol/state';
 import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
 import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service';
 import { IInstantiationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
 import { ILabelService } from '@codingame/monaco-vscode-api/vscode/vs/platform/label/common/label.service';
+import { AgentSandboxSettingId } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
 import { StorageScope, StorageTarget } from '@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage';
 import { IStorageService } from '@codingame/monaco-vscode-api/vscode/vs/platform/storage/common/storage.service';
 import { TerminalCapability } from '@codingame/monaco-vscode-api/vscode/vs/platform/terminal/common/capabilities/capabilities';
@@ -83,7 +85,7 @@ const TERMINAL_SANDBOX_DOCUMENTATION_URL = "https://aka.ms/vscode-sandboxing";
 const TOOL_REFERENCE_NAME = "runInTerminal";
 const LEGACY_TOOL_REFERENCE_FULL_NAMES = ["runCommands/runInTerminal"];
 const INPUT_NEEDED_NOTIFICATION_THROTTLE_MS = 5000;
-function createPowerShellModelDescription(shell, isSandboxEnabled, networkDomains) {
+function createPowerShellModelDescription(shell, isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains) {
     const isWinPwsh = isWindowsPowerShell(shell);
     const parts = [
         `This tool allows you to execute ${isWinPwsh ? "Windows PowerShell 5.1" : "PowerShell"} commands in a persistent terminal session, preserving environment variables, working directory, and other context across multiple commands.`,
@@ -105,14 +107,15 @@ function createPowerShellModelDescription(shell, isSandboxEnabled, networkDomain
         "- Use Get-Command to verify cmdlet/function availability",
         "",
         "Async Mode:",
-        "- For long-running tasks (e.g., servers), use mode=async",
+        "- Use mode=async ONLY for processes that should keep running while you do other work (servers, watchers, dev daemons)",
+        "- For one-shot long-running commands where you have nothing to do until they finish (package installs, builds, downloads, test suites), use mode=sync with a generous timeout (e.g. 600000 / 10 min for installs, longer for big builds) so the command can complete before your turn ends",
         "- Returns a terminal ID for checking status and runtime later",
         "- Use Start-Job for background PowerShell jobs",
         "",
         `Use ${TerminalToolId.SendToTerminal} to send commands or input to a terminal session.`
     ];
     if (isSandboxEnabled) {
-        parts.push(...createSandboxLines(networkDomains));
+        parts.push(...createSandboxLines(allowToRunUnsandboxedCommands, networkDomains));
     }
     parts.push(
         "",
@@ -130,28 +133,37 @@ function createPowerShellModelDescription(shell, isSandboxEnabled, networkDomain
         "- Use Test-Path to check file/directory existence",
         "- Be specific with Select-Object properties to avoid excessive output",
         "- Avoid printing credentials unless absolutely required",
-        `- NEVER run Start-Sleep or similar wait commands. You will be automatically notified on your next turn when async terminal commands or timed-out sync commands complete or need input. Use ${TerminalToolId.GetTerminalOutput} to check output before then`,
+        `- NEVER run Start-Sleep or similar wait commands. You will be automatically notified on your next turn when async terminal commands or timed-out sync commands complete or need input. Do NOT poll for completion.`,
         "",
         "Interactive Input Handling:",
         "- When a terminal command is waiting for interactive input, do NOT suggest alternatives or ask the user whether to proceed. Instead, use the vscode_askQuestions tool to collect the needed values from the user, then send them.",
+        `- NEVER use vscode_askQuestions to request sensitive input such as passwords, passphrases, API keys, tokens, or other secrets — answers to that tool are sent through the model. If the prompt requires a secret, tell the user to type it directly into the terminal and stop; do not call vscode_askQuestions or ${TerminalToolId.SendToTerminal} for that prompt.`,
         `- Send exactly one answer per prompt using ${TerminalToolId.SendToTerminal}. Never send multiple answers in a single send.`,
         `- After each send, call ${TerminalToolId.GetTerminalOutput} to read the next prompt before sending the next answer.`,
         "- Continue one prompt at a time until the command finishes."
     );
     return parts.join("\n");
 }
-function createSandboxLines(networkDomains) {
+function createSandboxLines(allowToRunUnsandboxedCommands, networkDomains) {
     const lines = [
         "",
         "Sandboxing:",
         "- ATTENTION: Terminal sandboxing is enabled, commands run in a sandbox by default",
         "- When executing commands within the sandboxed environment, all operations requiring a temporary directory must utilize the $TMPDIR environment variable. The /tmp directory is not guaranteed to be accessible or writable and must be avoided",
-        "- Tools and scripts should respect the TMPDIR environment variable, which is automatically set to an appropriate path within the sandbox",
-        "- When a command fails due to sandbox restrictions, immediately re-run it with requestUnsandboxedExecution=true. Do NOT ask the user for permission — setting this flag automatically shows a confirmation prompt to the user",
-        "- Only set requestUnsandboxedExecution=true when there is evidence of failures caused by the sandbox, e.g. 'Operation not permitted' errors, network failures, or file access errors, etc",
-        "- Do NOT set requestUnsandboxedExecution=true without first executing the command in sandbox mode. Always try the command in the sandbox first, and only set requestUnsandboxedExecution=true when retrying after that sandboxed execution failed due to sandbox restrictions.",
-        "- When setting requestUnsandboxedExecution=true, also provide requestUnsandboxedExecutionReason explaining why the command needs unsandboxed access"
+        "- Tools and scripts should respect the TMPDIR environment variable, which is automatically set to an appropriate path within the sandbox"
     ];
+    if (allowToRunUnsandboxedCommands) {
+        lines.push(
+            "- When a command fails due to sandbox restrictions, immediately re-run it with requestUnsandboxedExecution=true. Do NOT ask the user for permission — setting this flag automatically shows a confirmation prompt to the user",
+            "- Only set requestUnsandboxedExecution=true when there is evidence of failures caused by the sandbox, e.g. 'Operation not permitted' errors, network failures, or file access errors, etc",
+            "- Do NOT set requestUnsandboxedExecution=true without first executing the command in sandbox mode. Always try the command in the sandbox first, and only set requestUnsandboxedExecution=true when retrying after that sandboxed execution failed due to sandbox restrictions.",
+            "- When setting requestUnsandboxedExecution=true, also provide requestUnsandboxedExecutionReason explaining why the command needs unsandboxed access"
+        );
+    } else {
+        lines.push(
+            "- Running commands outside the sandbox is disabled by the current chat.agent.sandbox.allowUnsandboxedCommands setting. Do not set requestUnsandboxedExecution=true."
+        );
+    }
     if (networkDomains) {
         const deniedSet = ( new Set(networkDomains.deniedDomains));
         const effectiveAllowed = networkDomains.allowedDomains.filter(d => !( deniedSet.has(d)));
@@ -170,7 +182,7 @@ function createSandboxLines(networkDomains) {
     }
     return lines;
 }
-function createGenericDescription(isSandboxEnabled, networkDomains) {
+function createGenericDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains) {
     const parts = [`
 Command Execution:
 - Use && to chain simple commands on one line
@@ -190,12 +202,15 @@ Program Execution:
 - Use which or command -v to verify command availability
 
 Async Mode:
-- For long-running tasks (e.g., servers), use mode=async
+- Use mode=async ONLY for processes that should keep running while you do other work (servers, watchers, dev daemons)
+- For one-shot long-running commands where you have nothing to do until they finish (package installs, builds, downloads, test suites), use mode=sync with a generous timeout (e.g. 600000 / 10 min for installs, longer for big builds) so the command can complete before your turn ends
 - Returns a terminal ID for checking status and runtime later
 
 Use ${TerminalToolId.SendToTerminal} to send commands or input to a terminal session.`];
     if (isSandboxEnabled) {
-        parts.push(createSandboxLines(networkDomains).join("\n"));
+        parts.push(
+            createSandboxLines(allowToRunUnsandboxedCommands, networkDomains).join("\n")
+        );
     }
     parts.push(`
 
@@ -210,68 +225,69 @@ Best Practices:
 - Use find with -exec or xargs for file operations
 - Be specific with commands to avoid excessive output
 - Avoid printing credentials unless absolutely required
-- NEVER run sleep or similar wait commands in a terminal. You will be automatically notified on your next turn when async terminal commands or timed-out sync commands complete or need input. Use ${TerminalToolId.GetTerminalOutput} to check output before then
+- NEVER run sleep or similar wait commands in a terminal. You will be automatically notified on your next turn when async terminal commands or timed-out sync commands complete or need input. Do NOT poll for completion.
 
 Interactive Input Handling:
 - When a terminal command is waiting for interactive input, do NOT suggest alternatives or ask the user whether to proceed. Instead, use the vscode_askQuestions tool to collect the needed values from the user, then send them.
+- NEVER use vscode_askQuestions to request sensitive input such as passwords, passphrases, API keys, tokens, or other secrets — answers to that tool are sent through the model. If the prompt requires a secret, tell the user to type it directly into the terminal and stop; do not call vscode_askQuestions or send_to_terminal for that prompt.
 - Send exactly one answer per prompt using ${TerminalToolId.SendToTerminal}. Never send multiple answers in a single send.
 - After each send, call ${TerminalToolId.GetTerminalOutput} to read the next prompt before sending the next answer.
 - Continue one prompt at a time until the command finishes.`);
     return parts.join("");
 }
-function createBashModelDescription(isSandboxEnabled, networkDomains) {
+function createBashModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains) {
     return [
         "This tool allows you to execute shell commands in a persistent bash terminal session, preserving environment variables, working directory, and other context across multiple commands.",
-        createGenericDescription(isSandboxEnabled, networkDomains),
+        createGenericDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains),
         "- Use [[ ]] for conditional tests instead of [ ]",
-        "- Prefer $() over backticks for command substitution",
-        "- Use set -e at start of complex commands to exit on errors"
+        "- Prefer $() over backticks for command substitution"
     ].join("\n");
 }
-function createZshModelDescription(isSandboxEnabled, networkDomains) {
+function createZshModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains) {
     return [
         "This tool allows you to execute shell commands in a persistent zsh terminal session, preserving environment variables, working directory, and other context across multiple commands.",
-        createGenericDescription(isSandboxEnabled, networkDomains),
+        createGenericDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains),
         "- Use type to check command type (builtin, function, alias)",
         "- Use jobs, fg, bg for job control",
         "- Use [[ ]] for conditional tests instead of [ ]",
         "- Prefer $() over backticks for command substitution",
-        "- Use setopt errexit for strict error handling",
         "- Take advantage of zsh globbing features (**, extended globs)"
     ].join("\n");
 }
-function createFishModelDescription(isSandboxEnabled, networkDomains) {
+function createFishModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains) {
     return [
         "This tool allows you to execute shell commands in a persistent fish terminal session, preserving environment variables, working directory, and other context across multiple commands.",
-        createGenericDescription(isSandboxEnabled, networkDomains),
+        createGenericDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains),
         "- Use type to check command type (builtin, function, alias)",
         "- Use jobs, fg, bg for job control",
         "- Use test expressions for conditionals (no [[ ]] syntax)",
         "- Prefer command substitution with () syntax",
         "- Variables are arrays by default, use $var[1] for first element",
-        "- Use set -e for strict error handling",
         "- Take advantage of fish's autosuggestions and completions"
     ].join("\n");
 }
 async function createRunInTerminalToolData(accessor) {
     const instantiationService = accessor.get(IInstantiationService);
     const terminalSandboxService = accessor.get(ITerminalSandboxService);
+    const configurationService = accessor.get(IConfigurationService);
+    const allowToRunUnsandboxedCommands = configurationService.getValue(AgentSandboxSettingId.AgentSandboxAllowUnsandboxedCommands) === true;
     const profileFetcher = instantiationService.createInstance(TerminalProfileFetcher);
-    const [shell, os, isSandboxEnabled] = await Promise.all([
+    const [shell, os, isSandboxEnabled, isSandboxAllowNetworkEnabled] = await Promise.all([
         profileFetcher.getCopilotShell(),
         profileFetcher.osBackend,
-        terminalSandboxService.isEnabled()
+        terminalSandboxService.isEnabled(),
+        terminalSandboxService.isSandboxAllowNetworkEnabled()
     ]);
-    const networkDomains = isSandboxEnabled ? terminalSandboxService.getResolvedNetworkDomains() : undefined;
+    const networkDomains = isSandboxEnabled && !isSandboxAllowNetworkEnabled ? terminalSandboxService.getResolvedNetworkDomains() : undefined;
     let modelDescription;
     if (shell && os && isPowerShell(shell, os)) {
-        modelDescription = createPowerShellModelDescription(shell, isSandboxEnabled, networkDomains);
+        modelDescription = createPowerShellModelDescription(shell, isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains);
     } else if (shell && os && isZsh(shell, os)) {
-        modelDescription = createZshModelDescription(isSandboxEnabled, networkDomains);
+        modelDescription = createZshModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains);
     } else if (shell && os && isFish(shell, os)) {
-        modelDescription = createFishModelDescription(isSandboxEnabled, networkDomains);
+        modelDescription = createFishModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains);
     } else {
-        modelDescription = createBashModelDescription(isSandboxEnabled, networkDomains);
+        modelDescription = createBashModelDescription(isSandboxEnabled, allowToRunUnsandboxedCommands, networkDomains);
     }
     const sharedProperties = {
         command: {
@@ -288,6 +304,12 @@ async function createRunInTerminalToolData(accessor) {
         }
     };
     const sandboxProperties = isSandboxEnabled ? {
+        allowToRunUnsandboxedCommands: {
+            type: "boolean",
+            const: allowToRunUnsandboxedCommands,
+            default: allowToRunUnsandboxedCommands,
+            description: "Whether this tool invocation is allowed to run commands outside the terminal sandbox. This value is set by VS Code based on chat.agent.sandbox.allowUnsandboxedCommands."
+        },
         requestUnsandboxedExecution: {
             type: "boolean",
             description: "Request that this command run outside the terminal sandbox. Only set this after first executing the command in sandbox and observing that sandboxing caused the failure. The user will be prompted before the command runs unsandboxed."
@@ -301,9 +323,9 @@ async function createRunInTerminalToolData(accessor) {
         id: TerminalToolId.RunInTerminal,
         toolReferenceName: TOOL_REFERENCE_NAME,
         legacyToolReferenceFullNames: LEGACY_TOOL_REFERENCE_FULL_NAMES,
-        displayName: ( localize(14038, "Run in Terminal")),
-        modelDescription: `${modelDescription}\n\nExecution mode:\n- mode='sync': wait for completion up to timeout; if still running, return with a terminal ID.\n- mode='async': wait for an initial idle/output signal, then return with terminal output snapshot and ID. Timeout caps how long to wait for the initial idle/output signal.\n- Prefer mode='sync' for commands that will prompt for interactive input (e.g., npm init, interactive installers, configuration wizards).\n\nTerminal notifications: When an async command finishes or a sync command times out, you will be automatically notified on your next turn with the exit code and terminal output. You will also be notified if the terminal needs input. Use ${TerminalToolId.GetTerminalOutput} to check output before then. Do NOT poll or sleep to wait for completion.`,
-        userDescription: ( localize(14039, "Run commands in the terminal")),
+        displayName: ( localize(14327, "Run in Terminal")),
+        modelDescription: `${modelDescription}\n\nExecution mode:\n- mode='sync': wait for completion (optionally capped by timeout); if still running when timeout elapses, return with a terminal ID.\n- mode='async': wait for an initial idle/output signal, then return with terminal output snapshot and ID. Timeout caps how long to wait for the initial idle/output signal.\n- Prefer mode='sync' for commands that will prompt for interactive input (e.g., npm init, interactive installers, configuration wizards).\n\nTimeout parameter: For one-shot long-running commands, set a generous timeout as a safety net (e.g. 600000 for installs, longer for big builds). Omit timeout only for processes that should run indefinitely (servers, daemons). If the timeout elapses, you get a terminal ID and can check output later.\n\nTerminal notifications: When an async command finishes or a sync command times out, you will be automatically notified on your next turn with the exit code and terminal output. You will also be notified if the terminal needs input. Do NOT poll or sleep to wait for completion.`,
+        userDescription: ( localize(14328, "Run commands in the terminal")),
         source: ToolDataSource.Internal,
         icon: Codicon.terminal,
         inputSchema: {
@@ -326,10 +348,10 @@ async function createRunInTerminalToolData(accessor) {
                 },
                 timeout: {
                     type: "number",
-                    description: "Timeout in milliseconds that determines how long to wait before returning. Use 0 for no timeout."
+                    description: "Optional hard cap in milliseconds on how long the tool tracks the command before returning. Omit to let the command run to completion (recommended for package installs, builds, and long-running scripts). Use 0 to explicitly indicate no timeout."
                 }
             },
-            required: ["command", "explanation", "goal", "mode", "timeout"]
+            required: ["command", "explanation", "goal", "mode"]
         }
     };
 }
@@ -338,12 +360,12 @@ var TerminalToolStorageKeysInternal;
     TerminalToolStorageKeysInternal["TerminalSession"] = "chat.terminalSessions";
 })(TerminalToolStorageKeysInternal || (TerminalToolStorageKeysInternal = {}));
 function shouldAutomaticallyRetryUnsandboxed(options) {
-    return options.didSandboxWrapCommand && options.requestUnsandboxedExecution !== true && !options.isPersistentSession && !options.isBackgroundExecution && !options.didTimeout && options.exitCode !== 0 && outputLooksSandboxBlocked(options.output);
+    return options.allowUnsandboxedCommands && options.didSandboxWrapCommand && options.requestUnsandboxedExecution !== true && !options.isPersistentSession && !options.isBackgroundExecution && !options.didTimeout && options.exitCode !== 0 && outputLooksSandboxBlocked(options.output);
 }
 const telemetryIgnoredSequences = [
 "\u001b[I",
 "\u001b[O"];
-const altBufferMessage = "\n" + ( localize(14040, "The command opened the alternate buffer."));
+const altBufferMessage = "\n" + ( localize(14329, "The command opened the alternate buffer."));
 let RunInTerminalTool = class RunInTerminalTool extends Disposable {
     static {
         RunInTerminalTool_1 = this;
@@ -351,6 +373,9 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
     static {
         this._activeExecutions = ( new Map());
     }
+    static {
+        this._killedByTool = ( new Set());
+    }
     static getBackgroundOutput(id) {
         const execution = RunInTerminalTool_1._activeExecutions.get(id);
         if (!execution) {
@@ -370,6 +395,9 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         RunInTerminalTool_1._activeExecutions.delete(id);
         return true;
     }
+    static markKilledByTool(id) {
+        RunInTerminalTool_1._killedByTool.add(id);
+    }
     _resolveExecutionOptions(args) {
         const mode = args.mode ?? (args.isBackground ? "async" : "sync");
         switch (mode) {
@@ -388,6 +416,27 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             };
         }
     }
+    get _allowUnsandboxedCommands() {
+        return this._configurationService.getValue(AgentSandboxSettingId.AgentSandboxAllowUnsandboxedCommands) === true;
+    }
+    get _autoApproveUnsandboxedCommands() {
+        return this._allowUnsandboxedCommands && this._configurationService.getValue(AgentSandboxSettingId.AgentSandboxAutoApproveUnsandboxedCommands) === true;
+    }
+    get _allowSandboxAutoApprove() {
+        return this._configurationService.getValue(AgentSandboxSettingId.AgentSandboxAllowAutoApprove) === true;
+    }
+    _getAllowToRunUnsandboxedCommands(args) {
+        return (args.allowToRunUnsandboxedCommands ?? this._allowUnsandboxedCommands) === true && this._allowUnsandboxedCommands;
+    }
+    _shouldRejectUnsandboxedExecutionRequest(isSandboxEnabled, allowUnsandboxedCommands, args) {
+        return isSandboxEnabled && args.requestUnsandboxedExecution === true && !allowUnsandboxedCommands;
+    }
+    _getUnsandboxedExecutionDisabledMessage() {
+        return localize(
+            14330,
+            "The command was not executed because it requested to run outside the terminal sandbox, but running commands outside the sandbox is disabled by chat.agent.sandbox.allowUnsandboxedCommands. Run the command in the sandbox instead, or enable the setting to allow unsandboxed execution."
+        );
+    }
     get _enableCommandLineSandboxRewriting() {
         return true;
     }
@@ -444,9 +493,9 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             )
         ];
         if (this._enableCommandLineSandboxRewriting) {
-            this._commandLineRewriters.push(
-                this._register(this._instantiationService.createInstance(CommandLineSandboxRewriter))
-            );
+            this._commandLineRewriters.push(this._register(
+                this._instantiationService.createInstance(CommandLineSandboxRewriter, this._treeSitterCommandParser)
+            ));
         }
         this._commandLineRewriters.push(this._register(
             this._instantiationService.createInstance(CommandLineBackgroundDetachRewriter)
@@ -504,13 +553,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const partialInput = context.rawInput;
         if (partialInput && typeof partialInput === "object" && partialInput.command) {
             const truncatedCommand = buildCommandDisplayText(partialInput.command);
-            const invocationMessage = ( new MarkdownString(( localize(14041, "Running `{0}`", escapeMarkdownSyntaxTokens(truncatedCommand)))));
+            const invocationMessage = ( new MarkdownString(( localize(14331, "Running `{0}`", escapeMarkdownSyntaxTokens(truncatedCommand)))));
             return {
                 invocationMessage
             };
         }
         return {
-            invocationMessage: ( localize(14042, "Running command"))
+            invocationMessage: ( localize(14332, "Running command"))
         };
     }
     async prepareToolInvocation(context, token) {
@@ -527,26 +576,58 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const [os, shell, cwd, sandboxPrereqs] = await Promise.all([this._osBackend, this._profileFetcher.getCopilotShell(), (async () => {
             let cwd = await instance?.getCwdResource();
             if (!cwd) {
-                const activeWorkspaceRootUri = this._historyService.getLastActiveWorkspaceRoot();
-                const workspaceFolder = activeWorkspaceRootUri ? this._workspaceContextService.getWorkspaceFolder(activeWorkspaceRootUri) ?? undefined : undefined;
-                cwd = workspaceFolder?.uri;
+                const sessionModel = chatSessionResource ? this._chatService.getSession(chatSessionResource) : undefined;
+                if (sessionModel?.workingDirectory) {
+                    cwd = sessionModel.workingDirectory;
+                } else {
+                    const activeWorkspaceRootUri = this._historyService.getLastActiveWorkspaceRoot();
+                    const workspaceFolder = activeWorkspaceRootUri ? this._workspaceContextService.getWorkspaceFolder(activeWorkspaceRootUri) ?? undefined : undefined;
+                    cwd = workspaceFolder?.uri;
+                }
             }
             return cwd;
         })(), this._terminalSandboxService.checkForSandboxingPrereqs()]);
         const language = os === OperatingSystem.Windows ? "pwsh" : "sh";
-        const isTerminalSandboxEnabled = sandboxPrereqs.enabled;
-        const explicitUnsandboxRequest = isTerminalSandboxEnabled && args.requestUnsandboxedExecution === true;
+        const isSandboxEnabled = sandboxPrereqs.enabled;
+        const allowUnsandboxedCommands = this._getAllowToRunUnsandboxedCommands(args);
+        const explicitUnsandboxRequest = isSandboxEnabled && allowUnsandboxedCommands && args.requestUnsandboxedExecution === true;
         let requiresUnsandboxConfirmation = explicitUnsandboxRequest;
         let requestUnsandboxedExecutionReason = explicitUnsandboxRequest ? args.requestUnsandboxedExecutionReason : undefined;
         const missingDependencies = sandboxPrereqs.failedCheck === TerminalSandboxPrerequisiteCheck.Dependencies && sandboxPrereqs.missingDependencies?.length ? sandboxPrereqs.missingDependencies : undefined;
         const terminalToolSessionId = generateUuid();
         const terminalCommandId = `tool-${generateUuid()}`;
+        if (this._shouldRejectUnsandboxedExecutionRequest(isSandboxEnabled, allowUnsandboxedCommands, args)) {
+            const commandToDisplay = normalizeTerminalCommandForDisplay(args.command);
+            return {
+                invocationMessage: ( new MarkdownString(( localize(
+                    14333,
+                    "Not running `{0}` because unsandboxed execution is disabled",
+                    escapeMarkdownSyntaxTokens(buildCommandDisplayText(commandToDisplay))
+                )))),
+                icon: Codicon.error,
+                confirmationMessages: undefined,
+                toolSpecificData: {
+                    kind: "terminal",
+                    terminalToolSessionId,
+                    terminalCommandId,
+                    commandLine: {
+                        original: args.command,
+                        forDisplay: commandToDisplay
+                    },
+                    cwd,
+                    language,
+                    isBackground: executionOptions.persistentSession,
+                    requestUnsandboxedExecution: false,
+                    requestUnsandboxedExecutionReason: undefined
+                }
+            };
+        }
         const rewriteResult = await this._rewriteCommandLine(args.command, {
             cwd,
             shell,
             os,
             isBackground: executionOptions.persistentSession,
-            requestUnsandboxedExecution: requiresUnsandboxConfirmation,
+            requestUnsandboxedExecution: allowUnsandboxedCommands ? requiresUnsandboxConfirmation : false,
             requestUnsandboxedExecutionReason
         });
         const rewrittenCommand = rewriteResult.rewrittenCommand;
@@ -576,13 +657,21 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         if (missingDependencies) {
             const depsList = missingDependencies.join(", ");
             sandboxConfirmationMessageForMissingDeps = {
-                title: ( localize(14043, "Missing Sandbox Dependencies")),
+                title: ( localize(14334, "Missing Sandbox Dependencies")),
                 message: ( new MarkdownString(( localize(
-                    14044,
+                    14335,
                     "The following dependencies required for sandboxed execution are not installed: {0}. Would you like to install them?",
                     depsList
                 )))),
-                customButtons: [( localize(14045, "Install")), ( localize(14046, "Cancel"))]
+                customOptions: [{
+                    id: "install",
+                    label: ( localize(14336, "Install")),
+                    kind: ConfirmationOptionKind.Approve
+                }, {
+                    id: "cancel",
+                    label: ( localize(14337, "Cancel")),
+                    kind: ConfirmationOptionKind.Deny
+                }]
             };
         }
         const alternativeRecommendation = getRecommendedToolsOverRunInTerminal(args.command, this._languageModelToolsService);
@@ -615,7 +704,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             treeSitterLanguage: isPowerShell(shell, os) ? TreeSitterCommandParserLanguage.PowerShell : TreeSitterCommandParserLanguage.Bash,
             terminalToolSessionId,
             chatSessionResource,
-            requiresUnsandboxConfirmation
+            requiresUnsandboxConfirmation,
+            hasSessionAutoApproval: !!chatSessionResource && this._terminalChatService.hasChatSessionAutoApproval(chatSessionResource)
         };
         const isSessionAutoApproved = chatSessionResource && isSessionAutoApproveLevel(
             chatSessionResource,
@@ -653,7 +743,9 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const isAutoApprovedByRules =
         (isAutoApproveAllowed &&
         wouldBeAutoApproved);
-        const isFinalAutoApproved = isAutoApprovedByRules || ( commandLineAnalyzerResults.some(e => e.forceAutoApproval));
+        const isUnsandboxedAutoApproved = isSandboxEnabled && requiresUnsandboxConfirmation === true && this._autoApproveUnsandboxedCommands;
+        const isSandboxAutoApproved = isSandboxEnabled && toolSpecificData.commandLine.isSandboxWrapped === true && this._allowSandboxAutoApprove;
+        const isFinalAutoApproved = isUnsandboxedAutoApproved || isSandboxAutoApproved || isAutoApprovedByRules || ( commandLineAnalyzerResults.some(e => e.forceAutoApproval));
         if (isFinalAutoApproved || (isAutoApproveEnabled && ( commandLineAnalyzerResults.some(e => e.autoApproveInfo)))) {
             toolSpecificData.autoApproveInfo = commandLineAnalyzerResults.find(e => e.autoApproveInfo)?.autoApproveInfo;
         }
@@ -674,12 +766,12 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 cwdLabel: directoryLabel,
                 cdPrefix
             };
-            confirmationTitle = ( localize(14047, "Run `{0}` command within `{1}`?", shellType, directoryLabel));
+            confirmationTitle = ( localize(14338, "Run `{0}` command within `{1}`?", shellType, directoryLabel));
         } else {
             toolSpecificData.confirmation = {
                 commandLine: commandToDisplay
             };
-            confirmationTitle = ( localize(14048, "Run `{0}` command?", shellType));
+            confirmationTitle = ( localize(14339, "Run `{0}` command?", shellType));
         }
         const commandForPresenter = extractedCd?.command ?? commandToDisplay;
         let presenterInput = commandForPresenter;
@@ -700,7 +792,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 if (extractedCd && toolSpecificData.confirmation?.cwdLabel) {
                     if (presenterResult.languageDisplayName) {
                         confirmationTitle = ( localize(
-                            14049,
+                            14340,
                             "Run `{0}` command in `{1}` within `{2}`?",
                             presenterResult.languageDisplayName,
                             shellType,
@@ -708,7 +800,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                         ));
                     } else {
                         confirmationTitle = ( localize(
-                            14050,
+                            14341,
                             "Run command in `{0}` within `{1}`?",
                             shellType,
                             toolSpecificData.confirmation.cwdLabel
@@ -717,13 +809,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 } else {
                     if (presenterResult.languageDisplayName) {
                         confirmationTitle = ( localize(
-                            14051,
+                            14342,
                             "Run `{0}` command in `{1}`?",
                             presenterResult.languageDisplayName,
                             shellType
                         ));
                     } else {
-                        confirmationTitle = ( localize(14052, "Run command in `{0}`?", shellType));
+                        confirmationTitle = ( localize(14343, "Run command in `{0}`?", shellType));
                     }
                 }
                 if (!presenterResult.processOtherPresenters) {
@@ -734,29 +826,28 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         }
         if (requiresUnsandboxConfirmation) {
             confirmationTitle = blockedDomains?.length ? ( localize(
-                14053,
+                14344,
                 "Run `{0}` command outside the [sandbox]({1}) to access {2}?",
                 shellType,
                 TERMINAL_SANDBOX_DOCUMENTATION_URL,
                 this._formatBlockedDomainsForTitle(blockedDomains)
             )) : ( localize(
-                14054,
+                14345,
                 "Run `{0}` command outside the [sandbox]({1})?",
                 shellType,
                 TERMINAL_SANDBOX_DOCUMENTATION_URL
             ));
         }
         const shouldShowConfirmation = (!isFinalAutoApproved && !isSessionAutoApproved) || context.forceConfirmationReason !== undefined;
-        toolSpecificData.requiresConfirmationForRetry = (!isAutoApprovedByRules && !isSessionAutoApproved) || context.forceConfirmationReason !== undefined;
-        const explanation = args.explanation || ( localize(14055, "No explanation provided"));
-        const goal = args.goal || ( localize(14056, "No goal provided"));
+        const explanation = args.explanation || ( localize(14346, "No explanation provided"));
+        const goal = args.goal || ( localize(14347, "No goal provided"));
         const confirmationMessage = requiresUnsandboxConfirmation ? ( new MarkdownString(( localize(
-            14057,
+            14348,
             "Explanation: {0}\n\nGoal: {1}\n\nReason for leaving the sandbox: {2}",
             explanation,
             goal,
-            requestUnsandboxedExecutionReason || ( localize(14058, "The model indicated that this command needs unsandboxed access."))
-        )))) : ( new MarkdownString(( localize(14059, "Explanation: {0}\n\nGoal: {1}", explanation, goal))));
+            requestUnsandboxedExecutionReason || ( localize(14349, "The model indicated that this command needs unsandboxed access."))
+        )))) : ( new MarkdownString(( localize(14350, "Explanation: {0}\n\nGoal: {1}", explanation, goal))));
         const confirmationMessages = shouldShowConfirmation ? {
             title: confirmationTitle,
             message: confirmationMessage,
@@ -767,10 +858,10 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const rawDisplayCommand = toolSpecificData.commandLine.forDisplay ?? toolSpecificData.commandLine.toolEdited ?? toolSpecificData.commandLine.original;
         const displayCommand = rawDisplayCommand.length > 80 ? rawDisplayCommand.substring(0, 77) + "..." : rawDisplayCommand;
         const invocationMessage = toolSpecificData.commandLine.isSandboxWrapped ? ( new MarkdownString(( localize(
-            14060,
+            14351,
             "Running `{0}` in sandbox",
             escapeMarkdownSyntaxTokens(displayCommand)
-        )))) : ( new MarkdownString(( localize(14061, "Running `{0}`", escapeMarkdownSyntaxTokens(displayCommand)))));
+        )))) : ( new MarkdownString(( localize(14352, "Running `{0}`", escapeMarkdownSyntaxTokens(displayCommand)))));
         return {
             invocationMessage,
             icon: toolSpecificData.commandLine.isSandboxWrapped ? Codicon.terminalSecure : Codicon.terminal,
@@ -783,7 +874,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             return `\`${blockedDomains[0]}\``;
         }
         return localize(
-            14062,
+            14353,
             "`{0}` and {1} more domains",
             blockedDomains[0],
             blockedDomains.length - 1
@@ -793,13 +884,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         if (deniedDomains.length === blockedDomains.length && deniedDomains.length > 0) {
             if (blockedDomains.length === 1) {
                 return localize(
-                    14063,
+                    14354,
                     "This command accesses {0}, which is blocked by chat.agent.deniedNetworkDomains.",
                     blockedDomains[0]
                 );
             }
             return localize(
-                14064,
+                14355,
                 "This command accesses {0} and {1} more domains that are blocked by chat.agent.deniedNetworkDomains.",
                 blockedDomains[0],
                 blockedDomains.length - 1
@@ -808,13 +899,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         if (deniedDomains.length > 0) {
             if (blockedDomains.length === 1) {
                 return localize(
-                    14065,
+                    14356,
                     "This command accesses {0}, which is blocked by chat.agent.deniedNetworkDomains or not added to chat.agent.allowedNetworkDomains.",
                     blockedDomains[0]
                 );
             }
             return localize(
-                14066,
+                14357,
                 "This command accesses {0} and {1} more domains that are blocked by chat.agent.deniedNetworkDomains or not added to chat.agent.allowedNetworkDomains.",
                 blockedDomains[0],
                 blockedDomains.length - 1
@@ -822,13 +913,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         }
         if (blockedDomains.length === 1) {
             return localize(
-                14067,
+                14358,
                 "This command accesses {0}, which is not permitted by the current chat.agent.sandbox configuration.",
                 blockedDomains[0]
             );
         }
         return localize(
-            14068,
+            14359,
             "This command accesses {0} and {1} more domains that are not permitted by the current chat.agent.sandbox configuration.",
             blockedDomains[0],
             blockedDomains.length - 1
@@ -879,21 +970,22 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             blockedDomains
         };
     }
-    async _confirmAutomaticUnsandboxRetry(
-        sessionResource,
-        command,
-        shell,
-        blockedDomains,
-        requiresConfirmationForRetry,
-        token
-    ) {
-        if (requiresConfirmationForRetry === false) {
+    async _confirmAutomaticUnsandboxRetry(sessionResource, command, shell, blockedDomains, riskAssessment, token) {
+        if (this._autoApproveUnsandboxedCommands) {
             return true;
         }
         const chatModel = sessionResource && this._chatService.getSession(sessionResource);
         if (!(chatModel instanceof ChatModel)) {
             return false;
         }
+        if (sessionResource && isSessionAutoApproveLevel(
+            sessionResource,
+            this._configurationService,
+            this._chatWidgetService,
+            this._chatService
+        )) {
+            return true;
+        }
         const request = chatModel.getRequests().at(-1);
         if (!request) {
             return false;
@@ -916,13 +1008,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             const part = ( new ChatElicitationRequestPart(
                 this._getAutomaticUnsandboxRetryTitle(shellType, blockedDomains),
                 ( new MarkdownString(( localize(
-                14069,
+                14360,
                 "`{0}`",
                 escapeMarkdownSyntaxTokens(buildCommandDisplayText(command))
             )))),
                 "",
-                ( localize(14070, "Allow")),
-                ( localize(14071, "Skip")),
+                ( localize(14361, "Allow")),
+                ( localize(14362, "Skip")),
                 async () => {
                     resolveOnce(true);
                     part.hide();
@@ -935,7 +1027,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 },
                 undefined,
                 undefined,
-                () => resolveOnce(false)
+                () => resolveOnce(false),
+                riskAssessment
             ));
             chatModel.acceptResponseProgress(request, part);
             store.add(token.onCancellationRequested(() => resolveOnce(false)));
@@ -946,11 +1039,91 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
     }
     _getAutomaticUnsandboxRetryTitle(shellType, blockedDomains) {
         return blockedDomains?.length ? ( new MarkdownString(( localize(
-            14072,
+            14363,
             "Run `{0}` command outside the sandbox to access {1}?",
             shellType,
             this._formatBlockedDomainsForTitle(blockedDomains)
-        )))) : ( new MarkdownString(( localize(14073, "Run `{0}` command outside the sandbox?", shellType))));
+        )))) : ( new MarkdownString(( localize(14364, "Run `{0}` command outside the sandbox?", shellType))));
+    }
+    _registerSensitiveInputElicitation(
+        chatSessionResource,
+        terminalInstance,
+        outputMonitor,
+        cancelExecution,
+        onAutoCancelled
+    ) {
+        const store = ( new DisposableStore());
+        let pending;
+        let autoCancelled = false;
+        store.add(outputMonitor.onDidDetectSensitiveInputNeeded(() => {
+            if (pending || autoCancelled) {
+                return;
+            }
+            const isAutoApproved = chatSessionResource && isSessionAutoApproveLevel(
+                chatSessionResource,
+                this._configurationService,
+                this._chatWidgetService,
+                this._chatService
+            );
+            const chatModel = chatSessionResource && this._chatService.getSession(chatSessionResource);
+            if (isAutoApproved) {
+                autoCancelled = true;
+                if (chatModel instanceof ChatModel) {
+                    const request = chatModel.getRequests().at(-1);
+                    if (request) {
+                        const infoPart = ( new ChatElicitationRequestPart(( new MarkdownString(( localize(14365, "Terminal command cancelled — sensitive input required")))), ( new MarkdownString(( localize(
+                            14366,
+                            "The terminal command was prompting for a password or other secret. Auto-approve / autopilot mode cannot safely supply secrets, so the command was cancelled. Run the command interactively if you want to provide the secret."
+                        )))), "", ( localize(14367, "Dismiss")), "", async () => {
+                            infoPart.hide();
+                            return ElicitationState.Accepted;
+                        }, async () => {
+                            infoPart.hide();
+                            return ElicitationState.Rejected;
+                        }, undefined, undefined, undefined, undefined));
+                        chatModel.acceptResponseProgress(request, infoPart);
+                    }
+                }
+                onAutoCancelled?.();
+                cancelExecution();
+                return;
+            }
+            if (!(chatModel instanceof ChatModel)) {
+                this._terminalService.setActiveInstance(terminalInstance);
+                this._terminalService.revealTerminal(terminalInstance, true).catch(() => {});
+                terminalInstance.focus();
+                return;
+            }
+            const request = chatModel.getRequests().at(-1);
+            if (!request) {
+                return;
+            }
+            const part = ( new ChatElicitationRequestPart(( new MarkdownString(( localize(14368, "Terminal is waiting for sensitive input")))), ( new MarkdownString(( localize(
+                14369,
+                "The terminal command appears to be prompting for a password or other sensitive value. Focus the terminal to type it directly — secrets must not be sent through chat."
+            )))), "", ( localize(14370, "Focus Terminal")), ( localize(14371, "Cancel Command")), async () => {
+                pending = undefined;
+                part.hide();
+                try {
+                    this._terminalService.setActiveInstance(terminalInstance);
+                    await this._terminalService.revealTerminal(terminalInstance, true);
+                    terminalInstance.focus();
+                } catch (err) {
+                    this._logService.warn(`RunInTerminalTool: failed to reveal terminal for sensitive input`, err);
+                }
+                return ElicitationState.Accepted;
+            }, async () => {
+                pending = undefined;
+                part.hide();
+                cancelExecution();
+                return ElicitationState.Rejected;
+            }, undefined, undefined, () => {
+                pending = undefined;
+            }, undefined));
+            pending = part;
+            chatModel.acceptResponseProgress(request, part);
+        }));
+        return store;
     }
     _acceptAutomaticUnsandboxRetryToolInvocationUpdate(
         sessionResource,
@@ -973,10 +1146,10 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const progress = {
             kind: "externalToolInvocationUpdate",
             toolCallId,
-            toolName: ( localize(14038, "Run in Terminal")),
+            toolName: ( localize(14327, "Run in Terminal")),
             isComplete,
             invocationMessage: ( new MarkdownString(( localize(
-                14074,
+                14372,
                 "Running `{0}` outside the sandbox",
                 escapeMarkdownSyntaxTokens(displayCommand)
             )))),
@@ -1002,9 +1175,30 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 }]
             };
         }
+        const args = invocation.parameters;
+        const allowUnsandboxedCommands = this._getAllowToRunUnsandboxedCommands(args);
+        const isSandboxEnabled = await this._terminalSandboxService.isEnabled();
+        if (this._shouldRejectUnsandboxedExecutionRequest(isSandboxEnabled, allowUnsandboxedCommands, args)) {
+            const message = this._getUnsandboxedExecutionDisabledMessage();
+            return {
+                toolResultError: message,
+                toolResultDetails: {
+                    input: args.command,
+                    output: [{
+                        type: "embed",
+                        isText: true,
+                        value: message
+                    }],
+                    isError: true
+                },
+                content: [{
+                    kind: "text",
+                    value: message
+                }]
+            };
+        }
         if (toolSpecificData.missingSandboxDependencies?.length) {
-            const installButton = ( localize(14045, "Install"));
-            if (invocation.selectedCustomButton === installButton) {
+            if (invocation.selectedCustomButton === "install") {
                 const sessionResource = invocation.context.sessionResource;
                 const {
                     exitCode
@@ -1021,7 +1215,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                         content: [{
                             kind: "text",
                             value: ( localize(
-                                14075,
+                                14373,
                                 "Sandbox dependency installation failed (exit code {0}). The command was not executed.",
                                 exitCode
                             ))
@@ -1033,7 +1227,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                         content: [{
                             kind: "text",
                             value: ( localize(
-                                14076,
+                                14374,
                                 "Could not determine whether sandbox dependency installation succeeded. The command was not executed."
                             ))
                         }]
@@ -1047,12 +1241,11 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 return {
                     content: [{
                         kind: "text",
-                        value: ( localize(14077, "Sandbox dependency installation was cancelled by the user."))
+                        value: ( localize(14375, "Sandbox dependency installation was cancelled by the user."))
                     }]
                 };
             }
         }
-        const args = invocation.parameters;
         const executionOptions = this._resolveExecutionOptions(args);
         this._logService.debug(`RunInTerminalTool: Invoking with options ${JSON.stringify(args)}`);
         let toolResultMessage;
@@ -1065,16 +1258,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             };
         }
         if (executionOptions.mode === "sync" && args.timeout === undefined) {
-            if (args.isBackground === false) {
-                args.timeout = 0;
-            } else {
-                return {
-                    content: [{
-                        kind: "text",
-                        value: "Error: timeout is required for mode=sync and must be provided in milliseconds (use 0 for no timeout)."
-                    }]
-                };
-            }
+            args.timeout = 0;
         }
         const chatSessionResource = invocation.context.sessionResource;
         const shouldSendNotifications = !invocation.subAgentInvocationId;
@@ -1083,14 +1267,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         const didToolEditCommand = (!didUserEditCommand && toolSpecificData.commandLine.toolEdited !== undefined && toolSpecificData.commandLine.toolEdited !== toolSpecificData.commandLine.original &&
         normalizeTerminalCommandForDisplay(toolSpecificData.commandLine.toolEdited).trim() !== normalizeTerminalCommandForDisplay(toolSpecificData.commandLine.original).trim());
         const didSandboxWrapCommand = toolSpecificData.commandLine.isSandboxWrapped === true;
-        const isSandboxEnabled = await this._terminalSandboxService.isEnabled();
         const commandLineForMetadata = isSandboxEnabled ? toolSpecificData.commandLine.forDisplay ?? toolSpecificData.commandLine.original : undefined;
         if (token.isCancellationRequested) {
             throw ( new CancellationError());
         }
         let error;
         const automaticUnsandboxRetryReason = ( localize(
-            14078,
+            14376,
             "The sandboxed execution output indicated the sandbox blocked the command."
         ));
         const isNewSession = !executionOptions.persistentSession && !( this._sessionTerminalAssociations.has(chatSessionResource));
@@ -1129,6 +1312,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         let altBufferResult;
         let didTimeout = false;
         let didInputNeeded = false;
+        let didSensitiveAutoCancelled = false;
         let isBackgroundExecution = executionOptions.persistentSession;
         let timeoutPromise;
         let timeoutRacePromise;
@@ -1237,16 +1421,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                         resultText += `${outputAnalyzerMessage}\n`;
                     }
                     resultText += pollingResult.output;
-                    if (isSessionAutoApproveLevel(
-                        chatSessionResource,
-                        this._configurationService,
-                        this._chatWidgetService,
-                        this._chatService
-                    )) {
-                        resultText += `\nIf the command is waiting for input (not a normal shell prompt), determine the answer and call ${TerminalToolId.SendToTerminal}. Then call ${TerminalToolId.GetTerminalOutput} to read the next prompt. Repeat one prompt at a time.`;
-                    } else {
-                        resultText += `\nIf the command is waiting for input (not a normal shell prompt), call the vscode_askQuestions tool to ask the user. Then send each answer using ${TerminalToolId.SendToTerminal}, calling ${TerminalToolId.GetTerminalOutput} between each.`;
-                    }
+                    resultText += `\n${this._buildInputNeededSteeringText(chatSessionResource, termId,  false)}`;
                 } else if (pollingResult) {
                     resultText += `\n The command is still running, with output:\n`;
                     if (outputAnalyzerMessage) {
@@ -1269,6 +1444,19 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 };
             } else {
                 const raceCleanup = ( new DisposableStore());
+                startMarkerPromise.then(() => {
+                    if (outputMonitor && !raceCleanup.isDisposed) {
+                        raceCleanup.add(this._registerSensitiveInputElicitation(
+                            chatSessionResource,
+                            toolTerminal.instance,
+                            outputMonitor,
+                            () => executeCancellation.cancel(),
+                            () => {
+                                didSensitiveAutoCancelled = true;
+                            }
+                        ));
+                    }
+                });
                 const raceCandidates = [executionPromise.then(result => ({
                     type: "completed",
                     result
@@ -1416,7 +1604,15 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                     }
                 });
                 if (shouldSendNotifications) {
-                    this._registerCompletionNotification(toolTerminal.instance, termId, chatSessionResource, command, outputMonitor);
+                    const alreadyNotifiedInputNeededOutput = didInputNeeded ? terminalResult : undefined;
+                    this._registerCompletionNotification(
+                        toolTerminal.instance,
+                        termId,
+                        chatSessionResource,
+                        command,
+                        outputMonitor,
+                        alreadyNotifiedInputNeededOutput
+                    );
                 } else {
                     outputMonitor?.dispose();
                 }
@@ -1459,6 +1655,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             return altBufferResult;
         }
         const shouldAutoRetryUnsandboxed = shouldAutomaticallyRetryUnsandboxed({
+            allowUnsandboxedCommands,
             didSandboxWrapCommand,
             requestUnsandboxedExecution: args.requestUnsandboxedExecution === true,
             isPersistentSession: executionOptions.persistentSession,
@@ -1468,6 +1665,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             output: terminalResult
         });
         if (shouldAutoRetryUnsandboxed) {
+            const requestUnsandboxedExecution = allowUnsandboxedCommands;
             const [os, shell] = await Promise.all([this._osBackend, this._profileFetcher.getCopilotShell()]);
             const retryReason = automaticUnsandboxRetryReason;
             const retryRewriteResult = await this._rewriteCommandLine(args.command, {
@@ -1475,17 +1673,26 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 shell,
                 os,
                 isBackground: executionOptions.persistentSession,
-                requestUnsandboxedExecution: true,
+                requestUnsandboxedExecution,
                 requestUnsandboxedExecutionReason: retryReason
             });
             const rewrittenRetryReason = retryRewriteResult.requestUnsandboxedExecutionReason ?? retryReason;
             const retryConfirmationCommand = toolSpecificData.presentationOverrides?.commandLine ?? command;
+            const retryRiskAssessment = {
+                toolId: TerminalToolId.RunInTerminal,
+                parameters: {
+                    ...args,
+                    command: retryRewriteResult.rewrittenCommand,
+                    allowToRunUnsandboxedCommands: allowUnsandboxedCommands,
+                    requestUnsandboxedExecution
+                }
+            };
             const shouldRetry = await this._confirmAutomaticUnsandboxRetry(
                 invocation.context.sessionResource,
                 retryConfirmationCommand,
                 shell,
                 retryRewriteResult.blockedDomains,
-                toolSpecificData.requiresConfirmationForRetry,
+                retryRiskAssessment,
                 token
             );
             if (shouldRetry) {
@@ -1498,7 +1705,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                         forDisplay: retryRewriteResult.forDisplayCommand ?? normalizeTerminalCommandForDisplay(retryRewriteResult.rewrittenCommand ?? args.command),
                         isSandboxWrapped: retryRewriteResult.isSandboxWrapped
                     },
-                    requestUnsandboxedExecution: true,
+                    requestUnsandboxedExecution,
                     requestUnsandboxedExecutionReason: rewrittenRetryReason,
                     terminalCommandUri: undefined,
                     terminalCommandOutput: undefined,
@@ -1518,7 +1725,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                     parameters: {
                         ...args,
                         command: args.command,
-                        requestUnsandboxedExecution: true,
+                        allowToRunUnsandboxedCommands: allowUnsandboxedCommands,
+                        requestUnsandboxedExecution,
                         requestUnsandboxedExecutionReason: rewrittenRetryReason
                     },
                     toolSpecificData: retryToolSpecificData
@@ -1536,11 +1744,13 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         if (!didSandboxWrapCommand) {
             if (didUserEditCommand) {
                 resultText.push(
-                    `Note: The user manually edited the command to \`${command}\`, and this is the output of running that command instead:\n`
+                    `Note: The user manually edited the command to \`${command}\` (terminal ID=${termId}), and this is the output of running that command instead:\n`
                 );
             } else if (didToolEditCommand) {
+                const wasDetachedToBackground = /(^|\s)nohup\s|Start-Process\b/.test(command);
+                const stdinHint = wasDetachedToBackground ? " Note that stdin is closed for detached background processes; do not try to send input via send_to_terminal — re-run with mode=\"sync\" instead if interactive input is required." : "";
                 resultText.push(
-                    `Note: The tool simplified the command to \`${command}\`, and this is the output of running that command instead:\n`
+                    `Note: The tool simplified the command to \`${command}\` (terminal ID=${termId}).${stdinHint} This is the output of running that command instead:\n`
                 );
             }
             if (isBackgroundExecution && !executionOptions.persistentSession) {
@@ -1549,27 +1759,18 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 );
             }
         }
-        const isAutoApproved = isSessionAutoApproveLevel(
-            chatSessionResource,
-            this._configurationService,
-            this._chatWidgetService,
-            this._chatService
-        );
-        if (didInputNeeded) {
-            if (isAutoApproved) {
-                resultText.push(
-                    `Note: The command is running in terminal ID ${termId} and may be waiting for input. If it IS waiting for input (not a normal shell prompt), determine the answer and call ${TerminalToolId.SendToTerminal}. Then call ${TerminalToolId.GetTerminalOutput} to read the next prompt. Repeat one prompt at a time.\n\n`
-                );
-            } else {
-                resultText.push(
-                    `Note: The command is running in terminal ID ${termId} and may be waiting for input. If it IS waiting for input (not a normal shell prompt), call the vscode_askQuestions tool to ask the user. Then send each answer using ${TerminalToolId.SendToTerminal}, calling ${TerminalToolId.GetTerminalOutput} between each.\n\n`
-                );
-            }
+        if (didSensitiveAutoCancelled) {
+            resultText.push(
+                `Note: The command in terminal ID ${termId} was prompting for a password, passphrase, or other secret. The user is unavailable (auto-approve / autopilot mode is on, so no human can focus the terminal to type a secret) and the command has been cancelled. Stop, do NOT retry the command, do NOT call ${TerminalToolId.SendToTerminal}, and do NOT call vscode_askQuestions for the secret. Tell the user to run the command interactively when they are available.\n\n`
+            );
+        } else if (didInputNeeded) {
+            resultText.push(
+                `Note: The command is running in terminal ID ${termId} and may be waiting for input.\n${this._buildInputNeededSteeringText(chatSessionResource, termId,  false)}\n\n`
+            );
         } else if (didTimeout && timeoutValue !== undefined && timeoutValue > 0) {
             const notificationHint = shouldSendNotifications ? " You will be automatically notified on your next turn when it completes." : "";
-            const inputAction = isAutoApproved ? `If it IS waiting for input (not a normal shell prompt), determine the answer and call ${TerminalToolId.SendToTerminal}. Then call ${TerminalToolId.GetTerminalOutput} to read the next prompt. Repeat one prompt at a time.` : `If it IS waiting for input (not a normal shell prompt), call the vscode_askQuestions tool to ask the user. Then send each answer using ${TerminalToolId.SendToTerminal}, calling ${TerminalToolId.GetTerminalOutput} between each.`;
             resultText.push(
-                `Note: Command timed out after ${timeoutValue}ms. The command may still be running in terminal ID ${termId}.${notificationHint} Use ${TerminalToolId.GetTerminalOutput} to check output, ${TerminalToolId.SendToTerminal} to send input, or ${TerminalToolId.KillTerminal} to stop it. ${inputAction}\n\n`
+                `Note: Command timed out after ${timeoutValue}ms. The command may still be running in terminal ID ${termId}.${notificationHint}\n${this._buildInputNeededSteeringText(chatSessionResource, termId,  true)}\n\n`
             );
         }
         const outputAnalyzerMessage = await this._getOutputAnalyzerMessage(exitCode, terminalResult, command, didSandboxWrapCommand);
@@ -1588,7 +1789,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 terminalId: toolTerminal.instance.instanceId,
                 cwd: endCwd?.toString(),
                 timedOut: didTimeout || undefined,
-                timeoutMs: didTimeout ? timeoutValue : undefined
+                timeoutMs: didTimeout ? timeoutValue : undefined,
+                inputNeeded: didInputNeeded || undefined
             },
             toolResultDetails: isError ? {
                 input: command,
@@ -1605,6 +1807,39 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             }, ...imageContent]
         };
     }
+    _buildInputNeededSteeringText(chatSessionResource, termId, mentionTimeout) {
+        const isAutoApproved = isSessionAutoApproveLevel(
+            chatSessionResource,
+            this._configurationService,
+            this._chatWidgetService,
+            this._chatService
+        );
+        const lines = [];
+        lines.push(
+            `This note is not a signal to end the turn — pick one of the actions below and continue.`
+        );
+        if (isAutoApproved) {
+            lines.push(
+                `  1. If the output clearly ends with a non-secret input prompt (Continue? (y/n), Enter selection, etc. — a normal shell prompt like \`$\` or \`#\` does NOT count), determine the answer and immediately call ${TerminalToolId.SendToTerminal} with id="${termId}" (which returns the next few lines of output). Repeat one prompt at a time. Never guess passwords, passphrases, tokens, or other secrets — if the prompt requires a secret you do not have, inform the user and stop.`
+            );
+            lines.push(
+                `  2. If the command may still be producing output or the shell prompt has not returned, call ${TerminalToolId.GetTerminalOutput} with id="${termId}" to continue polling.`
+            );
+        } else {
+            lines.push(
+                `  1. If the command may still be producing output or the shell prompt has not returned, call ${TerminalToolId.GetTerminalOutput} with id="${termId}" to continue polling. This is the default and safest action when unsure.`
+            );
+            lines.push(
+                `  2. Only if the output clearly ends with a real non-secret input prompt (Continue? (y/n), Enter selection, etc. — a normal shell prompt like \`$\` or \`#\` does NOT count), call the vscode_askQuestions tool to ask the user, then send each answer using ${TerminalToolId.SendToTerminal} with id="${termId}" (which returns the next few lines of output). Repeat one prompt at a time. NEVER route secret prompts (passwords, passphrases, tokens, API keys, etc.) through vscode_askQuestions — answers to that tool are sent through the model. For secret prompts, tell the user to type the value directly into the terminal and stop.`
+            );
+        }
+        if (mentionTimeout) {
+            lines.push(
+                `  3. A timeout does not mean the command failed — call ${TerminalToolId.GetTerminalOutput} with id="${termId}" to continue polling. Only call ${TerminalToolId.KillTerminal} if the command is genuinely hung and you need to retry with a different approach.`
+            );
+        }
+        return lines.join("\n");
+    }
     async _getOutputAnalyzerMessage(exitCode, exitResult, commandLine, isSandboxWrapped) {
         for (const analyzer of this._outputAnalyzers) {
             const message = await analyzer.analyze({
@@ -1679,12 +1914,20 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         if (!isBackground) {
             const cachedTerminal = this._sessionTerminalAssociations.get(chatSessionResource);
             if (cachedTerminal && !cachedTerminal.isBackground && !cachedTerminal.instance.isDisposed) {
-                this._logService.debug(
-                    `RunInTerminalTool: Using cached terminal with session resource \`${chatSessionResource}\``
-                );
-                this._terminalToolCreator.refreshShellIntegrationQuality(cachedTerminal);
-                this._terminalChatService.registerTerminalInstanceWithToolSession(terminalToolSessionId, cachedTerminal.instance);
-                return cachedTerminal;
+                if (cachedTerminal.instance.exitCode !== undefined) {
+                    this._logService.info(
+                        `RunInTerminalTool: Cached terminal shell has exited (code=${cachedTerminal.instance.exitCode}), creating a new terminal`
+                    );
+                    this._sessionTerminalAssociations.delete(chatSessionResource);
+                } else {
+                    this._logService.debug(
+                        `RunInTerminalTool: Using cached terminal with session resource \`${chatSessionResource}\``
+                    );
+                    this._terminalToolCreator.refreshShellIntegrationQuality(cachedTerminal);
+                    this._terminalChatService.registerTerminalInstanceWithToolSession(terminalToolSessionId, cachedTerminal.instance);
+                    this._backgroundNotifications.deleteAndDispose(cachedTerminal.instance.instanceId);
+                    return cachedTerminal;
+                }
             }
         }
         this._logService.debug(
@@ -1905,8 +2148,16 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             RunInTerminalTool_1._activeExecutions.delete(termId);
         }
     }
-    _registerCompletionNotification(terminalInstance, termId, chatSessionResource, commandName, outputMonitor) {
-        this._backgroundNotifications.deleteAndDispose(termId);
+    _registerCompletionNotification(
+        terminalInstance,
+        termId,
+        chatSessionResource,
+        commandName,
+        outputMonitor,
+        alreadyNotifiedInputNeededOutput
+    ) {
+        const notificationKey = terminalInstance.instanceId;
+        this._backgroundNotifications.deleteAndDispose(notificationKey);
         const commandDetection = terminalInstance.capabilities.get(TerminalCapability.CommandDetection);
         if (!commandDetection) {
             outputMonitor?.dispose();
@@ -1931,7 +2182,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
         }
         const store = ( new DisposableStore());
         let userIsReplyingDirectly = false;
-        const disposeNotification = () => this._backgroundNotifications.deleteAndDispose(termId);
+        const disposeNotification = () => this._backgroundNotifications.deleteAndDispose(notificationKey);
         const handleSessionCancelled = () => {
             if (sessionRef.object.lastRequest?.response?.isCanceled) {
                 disposeNotification();
@@ -1951,8 +2202,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             }));
         }));
         if (outputMonitor) {
-            let lastInputNeededOutput = "";
-            let lastInputNeededNotificationTime = 0;
+            let lastInputNeededOutput = alreadyNotifiedInputNeededOutput ?? "";
+            let lastInputNeededNotificationTime = alreadyNotifiedInputNeededOutput !== undefined ? Date.now() : 0;
             const bgCts = ( new CancellationTokenSource());
             store.add(toDisposable(() => {
                 bgCts.cancel();
@@ -1960,6 +2211,12 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
             }));
             store.add(outputMonitor);
             outputMonitor.continueMonitoringAsync(bgCts.token);
+            store.add(
+                this._registerSensitiveInputElicitation(chatSessionResource, terminalInstance, outputMonitor, () => {
+                    const execution = RunInTerminalTool_1._activeExecutions.get(termId);
+                    execution?.dispose();
+                })
+            );
             store.add(outputMonitor.onDidDetectInputNeeded(() => {
                 if (userIsReplyingDirectly) {
                     this._logService.debug(
@@ -1982,14 +2239,8 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 }
                 lastInputNeededOutput = currentOutput;
                 lastInputNeededNotificationTime = now;
-                const isAutoApproved = isSessionAutoApproveLevel(
-                    chatSessionResource,
-                    this._configurationService,
-                    this._chatWidgetService,
-                    this._chatService
-                );
-                const inputAction = isAutoApproved ? `Determine the answer and call ${TerminalToolId.SendToTerminal}. Then call ${TerminalToolId.GetTerminalOutput} to read the next prompt. Repeat one prompt at a time. A normal shell prompt does NOT count as waiting for input.` : `Call the vscode_askQuestions tool to ask the user. Then send each answer using ${TerminalToolId.SendToTerminal}, calling ${TerminalToolId.GetTerminalOutput} between each. A normal shell prompt does NOT count as waiting for input.`;
-                const message = `[Terminal ${termId} notification: command is waiting for input. ${inputAction}]\nTerminal output:\n${currentOutput}`;
+                const inputAction = this._buildInputNeededSteeringText(chatSessionResource, termId,  false);
+                const message = `[Terminal ${termId} notification: command may be waiting for input — assess the output below.]\n${inputAction}\nTerminal output:\n${currentOutput}`;
                 this._logService.debug(
                     `RunInTerminalTool: Input needed in background terminal ${termId}, notifying chat session`
                 );
@@ -1997,7 +2248,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                     ...sendOptions,
                     queue: ChatRequestQueueKind.Steering,
                     isSystemInitiated: true,
-                    systemInitiatedLabel: ( localize(14079, "`{0}` needs input", commandName)),
+                    systemInitiatedLabel: ( localize(14377, "`{0}` may need input", commandName)),
                     terminalExecutionId: termId
                 }).catch(e => {
                     this._logService.warn(
@@ -2036,7 +2287,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 ...sendOptions,
                 queue: ChatRequestQueueKind.Steering,
                 isSystemInitiated: true,
-                systemInitiatedLabel: ( localize(14080, "`{0}` completed", commandName)),
+                systemInitiatedLabel: ( localize(14378, "`{0}` completed", commandName)),
                 terminalExecutionId: termId
             }).catch(e => {
                 this._logService.warn(
@@ -2045,8 +2296,35 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 );
             });
         }));
+        const executionForDisposal = RunInTerminalTool_1._activeExecutions.get(termId);
         store.add(terminalInstance.onDisposed(() => {
+            if (( RunInTerminalTool_1._killedByTool.has(termId))) {
+                disposeNotification();
+                return;
+            }
+            if (handleSessionCancelled()) {
+                return;
+            }
+            const currentOutput = executionForDisposal?.getOutput() ?? "";
+            const exitCode = terminalInstance.exitCode;
+            const exitCodeText = exitCode !== undefined ? ` with exit code ${exitCode}` : "";
             disposeNotification();
+            const message = `[Terminal ${termId} notification: terminal exited${exitCodeText}. The terminal process ended before the command could complete normally; further commands cannot be sent to this terminal ID.]\nTerminal output:\n${currentOutput}`;
+            this._logService.debug(
+                `RunInTerminalTool: Background terminal ${termId} disposed${exitCodeText}, notifying chat session`
+            );
+            this._chatService.sendRequest(chatSessionResource, message, {
+                ...sendOptions,
+                queue: ChatRequestQueueKind.Steering,
+                isSystemInitiated: true,
+                systemInitiatedLabel: ( localize(14379, "`{0}` terminal exited", commandName)),
+                terminalExecutionId: termId
+            }).catch(e => {
+                this._logService.warn(
+                    `RunInTerminalTool: Failed to send terminal-exited notification for terminal ${termId}`,
+                    e
+                );
+            });
         }));
         store.add(sessionRef.object.onDidChange(e => {
             if (e.kind === "removeRequest") {
@@ -2059,7 +2337,7 @@ let RunInTerminalTool = class RunInTerminalTool extends Disposable {
                 terminalInstance.dispose();
             }
         }));
-        this._backgroundNotifications.set(termId, store);
+        this._backgroundNotifications.set(notificationKey, store);
     }
     _dismissPendingCarouselsForTerminal(chatSessionResource, termId) {
         const model = this._chatService.getSession(chatSessionResource);
@@ -2128,6 +2406,7 @@ let ActiveTerminalExecution = class ActiveTerminalExecution extends Disposable {
         }));
     }
     _createStrategy(commandDetection) {
+        const isSyncMode = !this._isBackground;
         switch (this._toolTerminal.shellIntegrationQuality) {
         case ShellIntegrationQuality.None:
             return this._instantiationService.createInstance(
@@ -2143,7 +2422,12 @@ let ActiveTerminalExecution = class ActiveTerminalExecution extends Disposable {
                 commandDetection
             );
         case ShellIntegrationQuality.Rich:
-            return this._instantiationService.createInstance(RichExecuteStrategy, this._toolTerminal.instance, commandDetection);
+            return this._instantiationService.createInstance(
+                RichExecuteStrategy,
+                this._toolTerminal.instance,
+                commandDetection,
+                isSyncMode
+            );
         }
     }
     async start(commandLine, token, commandId, commandLineForMetadata) {