@codingame/monaco-vscode-katex-common 33.0.9 → 34.0.1

package/vscode/src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.js

@@ -1,788 +0,0 @@
-
-import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
-import { timeout } from '@codingame/monaco-vscode-api/vscode/vs/base/common/async';
-import { VSBuffer } from '@codingame/monaco-vscode-api/vscode/vs/base/common/buffer';
-import { Event } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
-import { Disposable, DisposableStore } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
-import { FileAccess } from '@codingame/monaco-vscode-api/vscode/vs/base/common/network';
-import { win32, posix, dirname } from '@codingame/monaco-vscode-api/vscode/vs/base/common/path';
-import { OS, OperatingSystem } from '@codingame/monaco-vscode-api/vscode/vs/base/common/platform';
-import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
-import { generateUuid } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uuid';
-import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
-import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
-import { IEnvironmentService } from '@codingame/monaco-vscode-api/vscode/vs/platform/environment/common/environment.service';
-import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service';
-import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
-import { IRemoteAgentService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/remote/common/remoteAgentService.service';
-import { TerminalChatAgentToolsSettingId } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration';
-import { AgentNetworkDomainSettingId } from '../../../../../platform/networkFilter/common/settings.js';
-import { matchesDomainPattern, normalizeDomain } from '../../../../../platform/networkFilter/common/domainMatcher.js';
-import { IWorkspaceContextService } from '@codingame/monaco-vscode-api/vscode/vs/platform/workspace/common/workspace.service';
-import { IProductService } from '@codingame/monaco-vscode-api/vscode/vs/platform/product/common/productService.service';
-import { WillShutdownJoinerOrder } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/lifecycle/common/lifecycle';
-import { ILifecycleService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/lifecycle/common/lifecycle.service';
-import { ISandboxHelperService } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/sandboxHelperService.service';
-import { TerminalCapability } from '@codingame/monaco-vscode-api/vscode/vs/platform/terminal/common/capabilities/capabilities';
-import { MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
-import { ChatElicitationRequestPart } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/model/chatProgressTypes/chatElicitationRequestPart';
-import { ChatModel } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/model/chatModel';
-import { ElicitationState } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/chatService/chatService';
-import { IChatService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/chat/common/chatService/chatService.service';
-import { SANDBOX_HELPER_CHANNEL_NAME, SandboxHelperChannelClient } from '../../../../../platform/sandbox/common/sandboxHelperIpc.js';
-import { AgentSandboxSettingId, AgentSandboxEnabledValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/sandbox/common/settings';
-import { TerminalSandboxPrerequisiteCheck } from '../../../../../platform/sandbox/common/terminalSandboxService.js';
-import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
-import { getTerminalSandboxReadAllowListForCommands } from './terminalSandboxReadAllowList.js';
-import { getTerminalSandboxRuntimeConfigurationForCommands } from './terminalSandboxRuntimeConfigurationPerOperation.js';
-
-var TerminalSandboxService_1;
-let TerminalSandboxService = class TerminalSandboxService extends Disposable {
-    static {
-        TerminalSandboxService_1 = this;
-    }
-    static {
-        this._sandboxTempDirName = "tmp";
-    }
-    static {
-        this._urlRegex = /(?:https?|wss?):\/\/[^\s'"`|&;<>]+/gi;
-    }
-    static {
-        this._sshRemoteRegex = /(?:^|[\s'"`])(?:[^\s@:'"`]+@)?([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(?::[^\s'"`|&;<>]+)(?=$|[\s'"`|&;<>])/gi;
-    }
-    static {
-        this._hostRegex = /(?:^|[\s'"`(=])([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})(?::\d+)?(?=(?:\/[^\s'"`|&;<>]*)?(?:$|[\s'"`)\]|,;|&<>]))/gi;
-    }
-    constructor(
-        _configurationService,
-        _fileService,
-        _environmentService,
-        _logService,
-        _remoteAgentService,
-        _workspaceContextService,
-        _productService,
-        _lifecycleService,
-        _sandboxHelperService,
-        _chatService
-    ) {
-        super();
-        this._configurationService = _configurationService;
-        this._fileService = _fileService;
-        this._environmentService = _environmentService;
-        this._logService = _logService;
-        this._remoteAgentService = _remoteAgentService;
-        this._workspaceContextService = _workspaceContextService;
-        this._productService = _productService;
-        this._lifecycleService = _lifecycleService;
-        this._sandboxHelperService = _sandboxHelperService;
-        this._chatService = _chatService;
-        this._srtPathResolved = false;
-        this._needsForceUpdateConfigFile = true;
-        this._remoteEnvDetails = null;
-        this._commandAllowListKeywords = [];
-        this._commandAllowListCommandDetails = [];
-        this._os = OS;
-        this._defaultWritePaths = [];
-        this._pathJoin = (...segments) => {
-            const path = this._os === OperatingSystem.Windows ? win32 : posix;
-            return path.join(...segments);
-        };
-        this._appRoot = dirname(( FileAccess.asFileUri("")).path);
-        const nativeEnv = this._environmentService;
-        this._execPath = nativeEnv.execPath;
-        this._sandboxSettingsId = generateUuid();
-        this._remoteEnvDetailsPromise = this._remoteAgentService.getEnvironment();
-        this._register(
-            Event.runAndSubscribe(this._configurationService.onDidChangeConfiguration, e => {
-                if (e?.affectsConfiguration(AgentSandboxSettingId.AgentSandboxEnabled) || e?.affectsConfiguration(AgentSandboxSettingId.DeprecatedAgentSandboxEnabled) || e?.affectsConfiguration(AgentNetworkDomainSettingId.AllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedSandboxAllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedOldAllowedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeniedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedSandboxDeniedNetworkDomains) || e?.affectsConfiguration(AgentNetworkDomainSettingId.DeprecatedOldDeniedNetworkDomains) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxLinuxFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxLinuxFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxMacFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxMacFileSystem) || e?.affectsConfiguration(TerminalChatAgentToolsSettingId.AgentSandboxAdvancedRuntime)) {
-                    this.setNeedsForceUpdateConfigFile();
-                }
-            })
-        );
-        this._register(this._workspaceContextService.onDidChangeWorkspaceFolders(() => {
-            this.setNeedsForceUpdateConfigFile();
-        }));
-        this._register(this._lifecycleService.onWillShutdown(e => {
-            if (!this._tempDir) {
-                return;
-            }
-            e.join(this._cleanupSandboxTempDir(), {
-                id: "join.deleteFilesInSandboxTempDir",
-                label: ( localize(14652, "Delete Files in Sandbox Temp Dir")),
-                order: WillShutdownJoinerOrder.Default
-            });
-        }));
-    }
-    async isEnabled() {
-        return await this._isSandboxConfiguredEnabled();
-    }
-    async isSandboxAllowNetworkEnabled() {
-        if (!(await this._isSandboxConfiguredEnabled())) {
-            return false;
-        }
-        return this._isSandboxAllowNetworkConfigured();
-    }
-    async getOS() {
-        this._remoteEnvDetails = await this._remoteEnvDetailsPromise;
-        this._os = this._remoteEnvDetails ? this._remoteEnvDetails.os : OS;
-        return this._os;
-    }
-    async wrapCommand(command, requestUnsandboxedExecution, shell, cwd, commandDetails) {
-        const normalizedCommandDetails = this._normalizeCommandDetails(commandDetails ?? []);
-        const normalizedCommandKeywords = this._normalizeCommandKeywords(( normalizedCommandDetails.map(command => command.keyword)));
-        const currentReadAllowListPaths = getTerminalSandboxReadAllowListForCommands(
-            this._os,
-            this._commandAllowListKeywords,
-            this._commandAllowListCommandDetails
-        );
-        const nextReadAllowListPaths = getTerminalSandboxReadAllowListForCommands(this._os, normalizedCommandKeywords, normalizedCommandDetails);
-        const currentRuntimeConfiguration = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
-        const nextRuntimeConfiguration = getTerminalSandboxRuntimeConfigurationForCommands(this._os, normalizedCommandDetails);
-        const shouldRefreshConfig = this._commandAllowListKeywords.length === 0 || this._needsForceUpdateConfigFile || !this._areStringArraysEqual(this._commandAllowListKeywords, normalizedCommandKeywords) || !this._areStringArraysEqual(currentReadAllowListPaths, nextReadAllowListPaths) || !this._areObjectsEqual(currentRuntimeConfiguration, nextRuntimeConfiguration) || this._commandCwd?.toString() !== cwd?.toString();
-        if (shouldRefreshConfig) {
-            this._commandAllowListKeywords = normalizedCommandKeywords;
-            this._commandAllowListCommandDetails = normalizedCommandDetails;
-            this._commandCwd = cwd;
-            await this.getSandboxConfigPath(true);
-        }
-        if (!this._sandboxConfigPath || !this._tempDir) {
-            throw ( new Error("Sandbox config path or temp dir not initialized"));
-        }
-        const allowUnsandboxedCommands = this._areUnsandboxedCommandsAllowed();
-        const blockedDomainResult = requestUnsandboxedExecution || !allowUnsandboxedCommands ? {
-            blockedDomains: [],
-            deniedDomains: []
-        } : this._getBlockedDomains(command);
-        if (!requestUnsandboxedExecution && allowUnsandboxedCommands && blockedDomainResult.blockedDomains.length > 0) {
-            return {
-                command: this._wrapUnsandboxedCommand(command, shell),
-                isSandboxWrapped: false,
-                blockedDomains: blockedDomainResult.blockedDomains,
-                deniedDomains: blockedDomainResult.deniedDomains,
-                requiresUnsandboxConfirmation: true
-            };
-        }
-        if (requestUnsandboxedExecution && allowUnsandboxedCommands) {
-            return {
-                command: this._wrapUnsandboxedCommand(command, shell),
-                isSandboxWrapped: false
-            };
-        }
-        if (!this._execPath) {
-            throw ( new Error("Executable path not set to run sandbox commands"));
-        }
-        if (!this._srtPath) {
-            throw ( new Error("Sandbox runtime path not resolved"));
-        }
-        if (!this._rgPath) {
-            throw ( new Error("Ripgrep path not resolved"));
-        }
-        const commandToRunInSandbox = this._getSandboxCommandWithPreservedCwd(command, cwd);
-        const sandboxRuntimeCommand = `PATH="$PATH:${dirname(this._rgPath)}" TMPDIR="${this._tempDir.path}" CLAUDE_TMPDIR="${this._tempDir.path}" "${this._execPath}" "${this._srtPath}" --settings "${this._sandboxConfigPath}" -c ${this._quoteShellArgument(commandToRunInSandbox)}`;
-        const wrappedCommand = this._os === OperatingSystem.Linux && cwd?.path && cwd.path !== this._tempDir.path ? `cd ${this._quoteShellArgument(this._tempDir.path)}; ${sandboxRuntimeCommand}` : sandboxRuntimeCommand;
-        if (this._remoteEnvDetails) {
-            return {
-                command: wrappedCommand,
-                isSandboxWrapped: true
-            };
-        }
-        return {
-            command: `ELECTRON_RUN_AS_NODE=1 ${wrappedCommand}`,
-            isSandboxWrapped: true
-        };
-    }
-    getTempDir() {
-        return this._tempDir;
-    }
-    setNeedsForceUpdateConfigFile() {
-        this._needsForceUpdateConfigFile = true;
-    }
-    async checkForSandboxingPrereqs(forceRefresh = false) {
-        if (!(await this._isSandboxConfiguredEnabled())) {
-            return {
-                enabled: false,
-                sandboxConfigPath: undefined,
-                failedCheck: undefined
-            };
-        }
-        const sandboxConfigPath = await this.getSandboxConfigPath(forceRefresh);
-        if (!sandboxConfigPath) {
-            return {
-                enabled: true,
-                sandboxConfigPath,
-                failedCheck: TerminalSandboxPrerequisiteCheck.Config
-            };
-        }
-        if (!(await this._checkSandboxDependencies(forceRefresh))) {
-            return {
-                enabled: true,
-                sandboxConfigPath,
-                failedCheck: TerminalSandboxPrerequisiteCheck.Dependencies,
-                missingDependencies: await this.getMissingSandboxDependencies()
-            };
-        }
-        return {
-            enabled: true,
-            sandboxConfigPath,
-            failedCheck: undefined
-        };
-    }
-    async getSandboxConfigPath(forceRefresh = false) {
-        if (!(await this._isSandboxConfiguredEnabled())) {
-            return undefined;
-        }
-        await this._resolveSrtPath();
-        if (!this._sandboxConfigPath || forceRefresh || this._needsForceUpdateConfigFile) {
-            this._sandboxConfigPath = await this._createSandboxConfig();
-            this._needsForceUpdateConfigFile = false;
-        }
-        return this._sandboxConfigPath;
-    }
-    async _checkSandboxDependencies(forceRefresh = false) {
-        const os = await this.getOS();
-        if (os === OperatingSystem.Windows) {
-            return false;
-        }
-        const sandboxDependencyStatus = await this._resolveSandboxDependencyStatus(forceRefresh);
-        this._sandboxDependencyStatus = sandboxDependencyStatus;
-        if (sandboxDependencyStatus && !sandboxDependencyStatus.bubblewrapInstalled) {
-            this._logService.warn("TerminalSandboxService: bubblewrap (bwrap) is not installed");
-        }
-        if (sandboxDependencyStatus && !sandboxDependencyStatus.socatInstalled) {
-            this._logService.warn("TerminalSandboxService: socat is not installed");
-        }
-        return sandboxDependencyStatus ? sandboxDependencyStatus.bubblewrapInstalled && sandboxDependencyStatus.socatInstalled : true;
-    }
-    async getMissingSandboxDependencies() {
-        const os = await this.getOS();
-        if (os === OperatingSystem.Windows) {
-            return [];
-        }
-        if (!this._sandboxDependencyStatus || !this._sandboxDependencyStatus.bubblewrapInstalled || !this._sandboxDependencyStatus.socatInstalled) {
-            this._sandboxDependencyStatus = await this._resolveSandboxDependencyStatus(true);
-        }
-        const missing = [];
-        if (this._sandboxDependencyStatus && !this._sandboxDependencyStatus.bubblewrapInstalled) {
-            missing.push("bubblewrap");
-        }
-        if (this._sandboxDependencyStatus && !this._sandboxDependencyStatus.socatInstalled) {
-            missing.push("socat");
-        }
-        return missing;
-    }
-    async installMissingSandboxDependencies(missingDependencies, sessionResource, token, options) {
-        const depsList = missingDependencies.join(" ");
-        const installCommand = `sudo apt install -y ${depsList}`;
-        const instance = await options.createTerminal();
-        let installCommandSent = false;
-        const completionPromise = ( new Promise(resolve => {
-            const store = ( new DisposableStore());
-            let resolved = false;
-            const resolveOnce = code => {
-                if (resolved) {
-                    return;
-                }
-                resolved = true;
-                store.dispose();
-                resolve(code);
-            };
-            const attachListener = () => {
-                const detection = instance.capabilities.get(TerminalCapability.CommandDetection);
-                if (detection) {
-                    store.add(detection.onCommandFinished(cmd => resolveOnce(cmd.exitCode)));
-                }
-            };
-            attachListener();
-            store.add(instance.capabilities.onDidAddCapability(e => {
-                if (e.id === TerminalCapability.CommandDetection) {
-                    attachListener();
-                }
-            }));
-            store.add(instance.onDisposed(() => resolveOnce(undefined)));
-            store.add(token.onCancellationRequested(() => resolveOnce(undefined)));
-            const safetyTimeout = timeout(5 * 60 * 1000);
-            store.add({
-                dispose: () => safetyTimeout.cancel()
-            });
-            safetyTimeout.then(() => resolveOnce(undefined));
-            const passwordPrompt = this._createMissingDependencyPasswordPrompt(sessionResource, {
-                focusTerminal: () => options.focusTerminal(instance),
-                onDidInputData: instance.onDidInputData,
-                onDisposed: instance.onDisposed,
-                didSendInstallCommand: () => installCommandSent
-            }, token);
-            store.add(passwordPrompt);
-        }));
-        await instance.sendText(installCommand, true);
-        installCommandSent = true;
-        return {
-            exitCode: await completionPromise
-        };
-    }
-    _createMissingDependencyPasswordPrompt(sessionResource, promptContext, token) {
-        const chatModel = sessionResource && this._chatService.getSession(sessionResource);
-        if (!(chatModel instanceof ChatModel)) {
-            return ( new DisposableStore());
-        }
-        const request = chatModel.getRequests().at(-1);
-        if (!request) {
-            return ( new DisposableStore());
-        }
-        const part = ( new ChatElicitationRequestPart(( localize(14653, "The terminal is awaiting input.")), ( new MarkdownString(( localize(
-            14654,
-            "Installing missing sandbox dependencies may prompt for your sudo password. Select Focus Terminal to type it in the terminal."
-        )))), "", ( localize(14655, "Focus Terminal")), undefined, async () => {
-            await promptContext.focusTerminal();
-            return ElicitationState.Pending;
-        }));
-        chatModel.acceptResponseProgress(request, part);
-        const store = ( new DisposableStore());
-        const disposePrompt = () => store.dispose();
-        store.add({
-            dispose: () => part.hide()
-        });
-        store.add(token.onCancellationRequested(disposePrompt));
-        store.add(promptContext.onDisposed(disposePrompt));
-        store.add(promptContext.onDidInputData(data => {
-            if (promptContext.didSendInstallCommand() && data.length > 0) {
-                disposePrompt();
-            }
-        }));
-        return store;
-    }
-    _quoteShellArgument(value) {
-        return `'${value.replace(/'/g, `'\\''`)}'`;
-    }
-    _getSandboxCommandWithPreservedCwd(command, cwd) {
-        if (this._os !== OperatingSystem.Linux || !cwd?.path || cwd.path === this._tempDir?.path) {
-            return command;
-        }
-        return `cd ${this._quoteShellArgument(cwd.path)} && ${command}`;
-    }
-    _wrapUnsandboxedCommand(command, shell) {
-        if (!this._tempDir?.path) {
-            return command;
-        }
-        if (!shell) {
-            return `(TMPDIR="${this._tempDir.path}"; export TMPDIR; ${command})`;
-        }
-        return `env TMPDIR="${this._tempDir.path}" ${this._quoteShellArgument(shell)} -c ${this._quoteShellArgument(command)}`;
-    }
-    _getBlockedDomains(command) {
-        if (this._isSandboxAllowNetworkConfigured()) {
-            return {
-                blockedDomains: [],
-                deniedDomains: []
-            };
-        }
-        const domains = this._extractDomains(command);
-        if (domains.length === 0) {
-            return {
-                blockedDomains: [],
-                deniedDomains: []
-            };
-        }
-        const {
-            allowedDomains,
-            deniedDomains
-        } = this.getResolvedNetworkDomains();
-        const blockedDomains = ( new Set());
-        const explicitlyDeniedDomains = ( new Set());
-        for (const domain of domains) {
-            if (( deniedDomains.some(pattern => matchesDomainPattern(domain, pattern)))) {
-                blockedDomains.add(domain);
-                explicitlyDeniedDomains.add(domain);
-                continue;
-            }
-            if (!( allowedDomains.some(pattern => matchesDomainPattern(domain, pattern)))) {
-                blockedDomains.add(domain);
-            }
-        }
-        return {
-            blockedDomains: [...blockedDomains],
-            deniedDomains: [...explicitlyDeniedDomains]
-        };
-    }
-    _extractDomains(command) {
-        const domains = ( new Set());
-        let match;
-        TerminalSandboxService_1._urlRegex.lastIndex = 0;
-        while ((match = TerminalSandboxService_1._urlRegex.exec(command)) !== null) {
-            const domain = this._extractDomainFromUrl(match[0]);
-            if (domain) {
-                domains.add(domain);
-            }
-        }
-        TerminalSandboxService_1._sshRemoteRegex.lastIndex = 0;
-        while ((match = TerminalSandboxService_1._sshRemoteRegex.exec(command)) !== null) {
-            const domain = normalizeDomain(match[1], true);
-            if (domain) {
-                domains.add(domain);
-            }
-        }
-        TerminalSandboxService_1._hostRegex.lastIndex = 0;
-        while ((match = TerminalSandboxService_1._hostRegex.exec(command)) !== null) {
-            const domain = normalizeDomain(match[1]);
-            if (domain) {
-                domains.add(domain);
-            }
-        }
-        return [...domains];
-    }
-    _extractDomainFromUrl(value) {
-        try {
-            const authority = ( URI.parse(value)).authority;
-            return normalizeDomain(authority, true);
-        } catch {
-            return undefined;
-        }
-    }
-    _normalizeCommandKeywords(commandKeywords) {
-        return [...( new Set(( commandKeywords.map(keyword => keyword.toLowerCase()))))].sort();
-    }
-    _normalizeCommandDetails(commandDetails) {
-        const seen = ( new Set());
-        const result = [];
-        for (const command of commandDetails) {
-            const normalizedCommand = {
-                keyword: command.keyword.toLowerCase(),
-                args: [...command.args]
-            };
-            const key = JSON.stringify(normalizedCommand);
-            if (!( seen.has(key))) {
-                seen.add(key);
-                result.push(normalizedCommand);
-            }
-        }
-        return result.sort(
-            (a, b) => a.keyword.localeCompare(b.keyword) || a.args.join("\u0000").localeCompare(b.args.join("\u0000"))
-        );
-    }
-    _areStringArraysEqual(a, b) {
-        return a.length === b.length && a.every((keyword, index) => keyword === b[index]);
-    }
-    _areObjectsEqual(a, b) {
-        return JSON.stringify(a) === JSON.stringify(b);
-    }
-    async _isSandboxConfiguredEnabled() {
-        const os = await this.getOS();
-        if (os === OperatingSystem.Windows) {
-            return false;
-        }
-        const value = this._getSandboxConfiguredEnabledValue();
-        return value === true || value === AgentSandboxEnabledValue.On || value === AgentSandboxEnabledValue.AllowNetwork;
-    }
-    async _resolveSrtPath() {
-        if (this._srtPathResolved) {
-            return;
-        }
-        this._srtPathResolved = true;
-        const remoteEnv = this._remoteEnvDetails || (await this._remoteEnvDetailsPromise);
-        if (remoteEnv) {
-            this._appRoot = remoteEnv.appRoot.path;
-            this._execPath = remoteEnv.execPath;
-        }
-        this._srtPath = this._pathJoin(
-            this._appRoot,
-            "node_modules",
-            "@vscode",
-            "sandbox-runtime",
-            "dist",
-            "cli.js"
-        );
-        this._rgPath = this._pathJoin(this._appRoot, "node_modules", "@vscode", "ripgrep", "bin", "rg");
-    }
-    async _createSandboxConfig() {
-        if ((await this.isEnabled()) && !this._tempDir) {
-            await this._initTempDir();
-        }
-        if (this._tempDir) {
-            const allowNetwork = await this.isSandboxAllowNetworkEnabled();
-            const linuxFileSystemSetting = this._os === OperatingSystem.Linux ? this._getSettingValue(
-                TerminalChatAgentToolsSettingId.AgentSandboxLinuxFileSystem,
-                TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxLinuxFileSystem
-            ) ?? {} : {};
-            const macFileSystemSetting = this._os === OperatingSystem.Macintosh ? this._getSettingValue(
-                TerminalChatAgentToolsSettingId.AgentSandboxMacFileSystem,
-                TerminalChatAgentToolsSettingId.DeprecatedAgentSandboxMacFileSystem
-            ) ?? {} : {};
-            const runtimeSetting = this._getSettingValue(TerminalChatAgentToolsSettingId.AgentSandboxAdvancedRuntime) ?? {};
-            const commandRuntimeSetting = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
-            const commandRuntimeAllowReadPaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowRead");
-            const commandRuntimeAllowWritePaths = this._getCommandRuntimeFileSystemPaths(commandRuntimeSetting, "allowWrite");
-            const configFileUri = URI.joinPath(this._tempDir, `vscode-sandbox-settings-${this._sandboxSettingsId}.json`);
-            let allowWritePaths = [];
-            let allowReadPaths = [];
-            let denyReadPaths = [];
-            let denyWritePaths;
-            if (this._os === OperatingSystem.Macintosh) {
-                allowWritePaths = this._updateAllowWritePathsWithWorkspaceFolders(macFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths);
-                allowReadPaths = this._updateAllowReadPathsWithAllowWrite(
-                    macFileSystemSetting.allowRead,
-                    allowWritePaths,
-                    commandRuntimeAllowReadPaths
-                );
-                denyReadPaths = this._updateDenyReadPathsWithHome(macFileSystemSetting.denyRead);
-                denyWritePaths = macFileSystemSetting.denyWrite;
-            } else if (this._os === OperatingSystem.Linux) {
-                allowWritePaths = this._resolveLinuxFileSystemPaths(
-                    this._updateAllowWritePathsWithWorkspaceFolders(linuxFileSystemSetting.allowWrite, commandRuntimeAllowWritePaths)
-                );
-                allowReadPaths = this._resolveLinuxFileSystemPaths(this._updateAllowReadPathsWithAllowWrite(
-                    linuxFileSystemSetting.allowRead,
-                    allowWritePaths,
-                    commandRuntimeAllowReadPaths
-                ));
-                denyReadPaths = this._resolveLinuxFileSystemPaths(this._updateDenyReadPathsWithHome(linuxFileSystemSetting.denyRead));
-                denyWritePaths = this._resolveLinuxFileSystemPaths(linuxFileSystemSetting.denyWrite);
-            }
-            const sandboxSettings = {
-                network: allowNetwork ? {
-                    allowedDomains: [],
-                    deniedDomains: [],
-                    enabled: false
-                } : this.getResolvedNetworkDomains(),
-                filesystem: {
-                    denyRead: denyReadPaths,
-                    allowRead: allowReadPaths,
-                    allowWrite: allowWritePaths,
-                    denyWrite: denyWritePaths
-                }
-            };
-            this._mergeAdditionalSandboxConfigProperties(
-                sandboxSettings,
-                allowNetwork ? this._withoutNetworkRuntimeSetting(runtimeSetting) : runtimeSetting
-            );
-            this._mergeAdditionalSandboxConfigProperties(sandboxSettings, commandRuntimeSetting);
-            this._sandboxConfigPath = configFileUri.path;
-            await this._fileService.createFile(
-                configFileUri,
-                VSBuffer.fromString(JSON.stringify(sandboxSettings, null, "\t")),
-                {
-                    overwrite: true
-                }
-            );
-            return this._sandboxConfigPath;
-        }
-        return undefined;
-    }
-    _getCommandRuntimeFileSystemPaths(runtimeSetting, key) {
-        const filesystem = runtimeSetting.filesystem;
-        if (!this._isObjectForSandboxConfigMerge(filesystem)) {
-            return [];
-        }
-        const paths = filesystem[key];
-        if (!Array.isArray(paths)) {
-            return [];
-        }
-        return paths.filter(path => typeof path === "string");
-    }
-    _withoutNetworkRuntimeSetting(runtimeSetting) {
-        const sanitizedRuntimeSetting = {
-            ...runtimeSetting
-        };
-        delete sanitizedRuntimeSetting.network;
-        return sanitizedRuntimeSetting;
-    }
-    _mergeAdditionalSandboxConfigProperties(target, additional) {
-        for (const [key, value] of Object.entries(additional)) {
-            if (!Object.prototype.hasOwnProperty.call(target, key)) {
-                target[key] = value;
-                continue;
-            }
-            const existingValue = target[key];
-            if (this._isObjectForSandboxConfigMerge(existingValue) && this._isObjectForSandboxConfigMerge(value)) {
-                this._mergeAdditionalSandboxConfigProperties(existingValue, value);
-            }
-        }
-    }
-    _isObjectForSandboxConfigMerge(value) {
-        return typeof value === "object" && value !== null && !Array.isArray(value);
-    }
-    async _initTempDir() {
-        if (await this.isEnabled()) {
-            this._needsForceUpdateConfigFile = true;
-            const remoteEnv = this._remoteEnvDetails || (await this._remoteEnvDetailsPromise);
-            this._tempDir = this._getSandboxTempDirPath(remoteEnv);
-            if (this._tempDir) {
-                await this._fileService.createFolder(this._tempDir);
-                this._defaultWritePaths.push(this._tempDir.path);
-            }
-            if (!this._tempDir) {
-                this._logService.warn(
-                    "TerminalSandboxService: Cannot create sandbox settings file because no tmpDir is available in this environment"
-                );
-            }
-        }
-    }
-    async _cleanupSandboxTempDir() {
-        if (!this._tempDir) {
-            return;
-        }
-        try {
-            await this._fileService.del(this._tempDir, {
-                recursive: true,
-                useTrash: false
-            });
-        } catch (error) {
-            this._logService.warn("TerminalSandboxService: Failed to delete sandbox temp dir", error);
-        }
-    }
-    _getSandboxTempDirPath(remoteEnv) {
-        const sandboxTempDirName = this._getSandboxWindowTempDirName();
-        if (remoteEnv?.userHome) {
-            const sandboxRoot = URI.joinPath(
-                remoteEnv.userHome,
-                this._productService.serverDataFolderName ?? this._productService.dataFolderName,
-                TerminalSandboxService_1._sandboxTempDirName
-            );
-            return sandboxTempDirName ? URI.joinPath(sandboxRoot, sandboxTempDirName) : sandboxRoot;
-        }
-        const nativeEnv = this._environmentService;
-        if (nativeEnv.userHome) {
-            const sandboxRoot = URI.joinPath(
-                nativeEnv.userHome,
-                this._productService.dataFolderName,
-                TerminalSandboxService_1._sandboxTempDirName
-            );
-            return sandboxTempDirName ? URI.joinPath(sandboxRoot, sandboxTempDirName) : sandboxRoot;
-        }
-        return undefined;
-    }
-    _getSandboxWindowTempDirName() {
-        const workbenchEnv = this._environmentService;
-        const windowId = workbenchEnv.window?.id;
-        return typeof windowId === "number" ? `tmp_vscode_${windowId}` : undefined;
-    }
-    getResolvedNetworkDomains() {
-        const allowedDomains = this._getSettingValue(
-            AgentNetworkDomainSettingId.AllowedNetworkDomains,
-            AgentNetworkDomainSettingId.DeprecatedSandboxAllowedNetworkDomains,
-            AgentNetworkDomainSettingId.DeprecatedOldAllowedNetworkDomains
-        ) ?? [];
-        const deniedDomains = this._getSettingValue(
-            AgentNetworkDomainSettingId.DeniedNetworkDomains,
-            AgentNetworkDomainSettingId.DeprecatedSandboxDeniedNetworkDomains,
-            AgentNetworkDomainSettingId.DeprecatedOldDeniedNetworkDomains
-        ) ?? [];
-        return {
-            allowedDomains,
-            deniedDomains
-        };
-    }
-    _updateAllowWritePathsWithWorkspaceFolders(configuredAllowWrite, commandRuntimeAllowWrite = []) {
-        const workspaceFolderPaths = ( this._workspaceContextService.getWorkspace().folders.map(folder => folder.uri.path));
-        return [...( new Set([
-            ...workspaceFolderPaths,
-            ...this._defaultWritePaths,
-            ...this._getWorkspaceStoragePaths(),
-            ...(configuredAllowWrite ?? []),
-            ...commandRuntimeAllowWrite
-        ]))];
-    }
-    _updateDenyReadPathsWithHome(configuredDenyRead) {
-        const userHome = this._getUserHomePath();
-        return [...( new Set([...(configuredDenyRead ?? []), ...(userHome ? [userHome] : [])]))];
-    }
-    _updateAllowReadPathsWithAllowWrite(configuredAllowRead, allowWrite, commandRuntimeAllowRead = []) {
-        return [...( new Set([
-            ...(configuredAllowRead ?? []),
-            ...getTerminalSandboxReadAllowListForCommands(
-                this._os,
-                this._commandAllowListKeywords,
-                this._commandAllowListCommandDetails
-            ),
-            ...commandRuntimeAllowRead,
-            ...this._getSandboxRuntimeReadPaths(),
-            ...allowWrite
-        ]))];
-    }
-    _resolveLinuxFileSystemPaths(paths) {
-        return ( (paths ?? []).map(path => this._expandHomePath(path)));
-    }
-    _expandHomePath(path) {
-        const userHome = this._getUserHomePath();
-        if (!userHome) {
-            return path;
-        }
-        if (path === "~") {
-            return userHome;
-        }
-        if (path.startsWith("~/")) {
-            return this._pathJoin(userHome, path.slice(2));
-        }
-        return path;
-    }
-    _getSandboxRuntimeReadPaths() {
-        const paths = [this._appRoot];
-        if (this._execPath) {
-            for (const path of [this._execPath, dirname(this._execPath)]) {
-                if (!this._isPathUnderAppRoot(path)) {
-                    paths.push(path);
-                }
-            }
-        }
-        return paths;
-    }
-    _isPathUnderAppRoot(path) {
-        return path === this._appRoot || path.startsWith(
-            `${this._appRoot}${this._os === OperatingSystem.Windows ? win32.sep : posix.sep}`
-        );
-    }
-    _getWorkspaceStoragePaths() {
-        const workspaceStorageHome = this._remoteEnvDetails?.workspaceStorageHome ?? this._environmentService.workspaceStorageHome;
-        const workspaceId = this._workspaceContextService.getWorkspace().id;
-        return [URI.joinPath(workspaceStorageHome, workspaceId).path];
-    }
-    _getUserHomePath() {
-        const nativeEnv = this._environmentService;
-        return this._remoteEnvDetails?.userHome?.path ?? nativeEnv.userHome?.path;
-    }
-    async _resolveSandboxDependencyStatus(forceRefresh = false) {
-        if (!forceRefresh && this._sandboxDependencyStatus) {
-            return this._sandboxDependencyStatus;
-        }
-        const connection = this._remoteAgentService.getConnection();
-        if (connection) {
-            return connection.withChannel(SANDBOX_HELPER_CHANNEL_NAME, channel => {
-                const sandboxHelper = ( new SandboxHelperChannelClient(channel));
-                return sandboxHelper.checkSandboxDependencies();
-            });
-        }
-        return this._sandboxHelperService.checkSandboxDependencies();
-    }
-    _getSandboxConfiguredEnabledValue() {
-        return this._getSettingValue(
-            AgentSandboxSettingId.AgentSandboxEnabled,
-            AgentSandboxSettingId.DeprecatedAgentSandboxEnabled
-        ) ?? AgentSandboxEnabledValue.Off;
-    }
-    _isSandboxAllowNetworkConfigured() {
-        return this._getSandboxConfiguredEnabledValue() === AgentSandboxEnabledValue.AllowNetwork;
-    }
-    _areUnsandboxedCommandsAllowed() {
-        return this._getSettingValue(AgentSandboxSettingId.AgentSandboxAllowUnsandboxedCommands) === true;
-    }
-    _getSettingValue(settingId, ...deprecatedSettingIds) {
-        const setting = this._configurationService.inspect(settingId);
-        if (setting.userValue !== undefined) {
-            return setting.value;
-        }
-        if (deprecatedSettingIds.length > 0) {
-            const userConfiguredKeys = ( this._configurationService.keys()).user;
-            for (const deprecatedId of deprecatedSettingIds) {
-                const deprecated = this._configurationService.inspect(deprecatedId);
-                if (deprecated.userValue !== undefined && userConfiguredKeys.includes(deprecatedId)) {
-                    this._logService.warn(
-                        `TerminalSandboxService: Using deprecated setting ${deprecatedId} because ${settingId} is not set. Please update your settings to use ${settingId} instead.`
-                    );
-                    return deprecated.value;
-                }
-            }
-        }
-        return setting.value;
-    }
-};
-TerminalSandboxService = TerminalSandboxService_1 = ( __decorate([( __param(0, IConfigurationService)), ( __param(1, IFileService)), ( __param(2, IEnvironmentService)), ( __param(3, ILogService)), ( __param(4, IRemoteAgentService)), ( __param(5, IWorkspaceContextService)), ( __param(6, IProductService)), ( __param(7, ILifecycleService)), ( __param(8, ISandboxHelperService)), ( __param(9, IChatService))], TerminalSandboxService));
-
-export { TerminalSandboxPrerequisiteCheck, TerminalSandboxService };