Skip to content

[TerminalSandboxing]:Fixing issues with macOS #302288

Draft
dileepyavan wants to merge 11 commits intomainfrom
DileepY/trustedDomains_enable
Draft

[TerminalSandboxing]:Fixing issues with macOS #302288
dileepyavan wants to merge 11 commits intomainfrom
DileepY/trustedDomains_enable

Conversation

@dileepyavan
Copy link
Member

This PR includes the below changes:

  • Pass the env details from terminal sandbox service to avoid any path issues.
  • In terminal tool, do not show the sandboxed command.
  • Include ripgrep path in the runtime config instead of setting PATH env variable.

Copilot AI review requested due to automatic review settings March 16, 2026 22:57
@vs-code-engineering vs-code-engineering bot added this to the 1.112.0 milestone Mar 16, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR extends the terminal sandboxing flow used by chat agent terminal tools, adding extra metadata to track when commands are sandbox-wrapped and enhancing sandbox initialization to pass temp dir and ripgrep details through the sandbox helper.

Changes:

  • Add isSandboxWrapped metadata through command-line rewriters into terminal tool invocation data for improved messaging/telemetry.
  • Update sandbox helper IPC/service APIs to accept optional environment-prefix details when wrapping commands.
  • Extend TerminalSandboxService to resolve runtime paths (ripgrep) and temp dir for sandbox execution.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/sandboxedCommandLinePresenter.test.ts Updates test stub to satisfy new sandbox service interface shape.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts Adds temp dir + ripgrep runtime config resolution and hooks sandbox reset to config/trusted-domain changes.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/runInTerminalTool.ts Threads isSandboxWrapped through tool data and adjusts user-facing result notes.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineRewriter/commandLineSandboxRewriter.ts Marks sandbox rewrite results with isSandboxWrapped: true.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/commandLineRewriter/commandLineRewriter.ts Extends rewriter result contract with isSandboxWrapped?: boolean.
src/vs/workbench/contrib/chat/common/chatService/chatService.ts Extends terminal invocation data schema to include isSandboxWrapped.
src/vs/platform/sandbox/node/sandboxHelperService.ts Adds optional env prefix handling and refactors sandbox init/wrap separation.
src/vs/platform/sandbox/node/sandboxHelperChannel.ts Wires new optional argument across IPC for wrapWithSandbox.
src/vs/platform/sandbox/common/sandboxHelperService.ts Updates service interface signature for wrapWithSandbox(..., envDetails?).

You can also share your feedback on Copilot code review. Take the survey.

Comment on lines +174 to +178
// Quote shell arguments so the wrapped command cannot break out of the outer shell.
let envDetails = `TMPDIR="${this._tempDir.path}"`;
if (!this._remoteEnvDetails) {
envDetails = `ELECTRON_RUN_AS_NODE=1 ${envDetails}`;
}
dileepyavan and others added 2 commits March 16, 2026 16:05
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@dileepyavan dileepyavan marked this pull request as draft March 16, 2026 23:34
@dileepyavan dileepyavan modified the milestones: 1.112.0, 1.113.0 Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants