Vihren Atlas

terminalSandboxEngine.ts ×10

Code frontier

unlabeled · c_11937d08f752

23 tests · 12599 LOC · 56 files · introduces 0 tests · 45 LOC · 1 file

Introduces — evidence that enters the hierarchy at this concept

Code
10 ranges45 lines · 1 files
Tests
0 tests

Contains — complete concept membership

All code (extent)
1980 ranges12599 lines · 56 files · Browse complete extent
All tests (intent)
23 testsBrowse complete intent

Neighbourhood graph

The orange circle is the focus. Violet and green circles are every ancestor and descendant, broader and narrower, at any distance; blue squares and pink diamonds are the introduced files and exact introduced tests of every visible concept, not only the focus's. Arrows point from broader to narrower concepts and bridge only concepts omitted from this view. Undirected links show source or test introduction. Concept and file size follows LOC; exact test nodes use test-count units.

Introduced files, introduced tests, and structurally relevant concept specialization

In the embedded map, ordinary wheel input scrolls the page; use the visible controls to zoom and drag to pan. Open the full-screen map for canvas navigation: wheel pans, Ctrl/Command plus wheel zooms, and arrow keys pan when this region is focused. On touch screens, open the full-screen map to pan or pinch. If JavaScript or WebGL is unavailable, use the native relationship evidence on this page.

Graph controls are ready.

Interactive rendering requires JavaScript and WebGL. Use the native relationship evidence on this page while the interactive map is unavailable.

Native relationship evidence

Every exact file and test below is linked only from the concept that introduces it.

Introduced tests

Every collected test enters the hierarchy at exactly one concept.

No tests are introduced at this concept. Its intent tests are introduced by other concepts.

Introduced code

Every collected source range enters the hierarchy at exactly one concept.

1 file ranked by introduced lines: 45 introduced LOC across 10 ranges. Expand a file to inspect source; the > gutter marks introduced lines.

src/vs/platform/sandbox/common/terminalSandboxEngine.ts 45 introduced LOC · 10 ranges

Open complete file

207
208 async wrapCommand(command: string, requestUnsandboxedExecution?: boolean, shell?: string, cwd?: URI, commandDetails?: readonly ITerminalSandboxCommand[], requestAllowNetwork?: boolean): Promise<ITerminalSandboxWrapResult> {
209 > const allowUnsandboxedCommands = this._areUnsandboxedCommandsAllowed(); terminalSandboxEngine.ts
210 > const retryWithAllowNetworkRequests = this._areRetryWithAllowNetworkRequestsAllowed();
211 > const shouldInspectBlockedDomains = requestUnsandboxedExecution !== true && requestAllowNetwork !== true && (retryWithAllowNetworkRequests || allowUnsandboxedCommands);
212 > const blockedDomainResult = shouldInspectBlockedDomains ? this._getBlockedDomains(command) : { blockedDomains: [], deniedDomains: [] };
213 > const requiresPreflightAllowNetwork = retryWithAllowNetworkRequests && blockedDomainResult.blockedDomains.length > 0;
214 > const allowNetworkForCommand = requestUnsandboxedExecution !== true && ((requestAllowNetwork === true && retryWithAllowNetworkRequests) || requiresPreflightAllowNetwork);
215 > const normalizedCommandDetails = this._normalizeCommandDetails(commandDetails ?? []);
216 > const normalizedCommandKeywords = this._normalizeCommandKeywords(normalizedCommandDetails.map(c => c.keyword));
217 > const currentReadAllowListPaths = getTerminalSandboxReadAllowListForCommands(this._os, this._commandAllowListKeywords, this._commandAllowListCommandDetails);
218 > const nextReadAllowListPaths = getTerminalSandboxReadAllowListForCommands(this._os, normalizedCommandKeywords, normalizedCommandDetails);
219 > const currentRuntimeConfiguration = getTerminalSandboxRuntimeConfigurationForCommands(this._os, this._commandAllowListCommandDetails);
220 > const nextRuntimeConfiguration = getTerminalSandboxRuntimeConfigurationForCommands(this._os, normalizedCommandDetails);
221 > const shouldRefreshConfig = this._commandAllowListKeywords.length === 0
222 || this._needsForceUpdateConfigFile
223 || !this._areStringArraysEqual(this._commandAllowListKeywords, normalizedCommandKeywords)
227 || this._commandAllowNetwork !== allowNetworkForCommand
228 || (this._os === OperatingSystem.Windows && (this._commandLine !== command || this._commandShell !== shell));
229 > if (shouldRefreshConfig) { terminalSandboxEngine.ts
230 > this._commandAllowListKeywords = normalizedCommandKeywords;
231 > this._commandAllowListCommandDetails = normalizedCommandDetails;
232 > this._commandCwd = cwd;
233 > this._commandLine = command;
234 > this._commandShell = shell;
235 > this._commandAllowNetwork = allowNetworkForCommand;
236 > await this.getSandboxConfigPath(true);
237 > }
238 >
239 > if (!this._sandboxConfigPath || !this._tempDir) {
240 throw new Error('Sandbox config path or temp dir not initialized');
241 }
242 > terminalSandboxEngine.ts
243 > // If per-command network relaxation is disabled, preserve the existing
244 > // unsandbox fallback for commands with statically-detected blocked domains.
245 > if (!requestUnsandboxedExecution && !retryWithAllowNetworkRequests && allowUnsandboxedCommands && blockedDomainResult.blockedDomains.length > 0) {
246 return {
247 command: this._wrapUnsandboxedCommand(command, shell),
254
255 // If requestUnsandboxedExecution is true, need to ensure env variables set during sandbox still apply.
256 > if (requestUnsandboxedExecution && allowUnsandboxedCommands) { terminalSandboxEngine.ts
257 return {
258 command: this._wrapUnsandboxedCommand(command, shell),
264 blockedDomains: blockedDomainResult.blockedDomains,
265 deniedDomains: blockedDomainResult.deniedDomains,
266 > } : undefined; terminalSandboxEngine.ts
267 >
268 > if (this._os === OperatingSystem.Windows) {
269 if (!this._mxcPath) {
270 throw new Error('MXC executable path not resolved');
307 command: this._wrapSandboxRuntimeCommandForLaunch(sandboxRuntimeCommand, cwd),
308 isSandboxWrapped: true,
309 > requiresAllowNetworkConfirmation: allowNetworkForCommand && !this._isSandboxAllowNetworkConfigured() ? true : undefined, terminalSandboxEngine.ts
310 > ...allowNetworkConfirmationMetadata,
311 > };
312 > }
313
314 async checkForSandboxingPrereqs(forceRefresh: boolean = false, precheckInputs?: ITerminalSandboxPrecheckInputs): Promise<ITerminalSandboxPrerequisiteCheckResult> {
560
561 private _normalizeCommandKeywords(commandKeywords: readonly string[]): string[] {
562 > return [...new Set(commandKeywords.map(keyword => keyword.toLowerCase()))].sort(); terminalSandboxEngine.ts
563 > }
564
565 private _normalizeCommandDetails(commandDetails: readonly ITerminalSandboxCommand[]): ITerminalSandboxCommand[] {
566 > const seen = new Set<string>(); terminalSandboxEngine.ts
567 > const result: ITerminalSandboxCommand[] = [];
568 > for (const command of commandDetails) {
569 const normalizedCommand = { keyword: command.keyword.toLowerCase(), args: [...command.args] };
570 const key = JSON.stringify(normalizedCommand);
574 }
575 }
576 > return result.sort((a, b) => a.keyword.localeCompare(b.keyword) || a.args.join('\0').localeCompare(b.args.join('\0'))); terminalSandboxEngine.ts
577 > }
578
579 private _areStringArraysEqual(a: readonly string[], b: readonly string[]): boolean {
1075
1076 private _areRetryWithAllowNetworkRequestsAllowed(): boolean {
1077 > return this._getSettingValue<boolean>(AgentSandboxSettingId.AgentSandboxRetryWithAllowNetworkRequests) === true; terminalSandboxEngine.ts
1078 > }
1079
1080 private _getSettingValue<T>(settingId: AgentSandboxSettingId | AgentNetworkDomainSettingId): T | undefined {

Direct hierarchy

Parents

Children