1
>
/*---------------------------------------------------------------------------------------------
sandboxConfigForSdk.ts
2
>
* Copyright (c) Microsoft Corporation. All rights reserved.
3
>
* Licensed under the MIT License. See License.txt in the project root for license information.
4
>
*--------------------------------------------------------------------------------------------*/
5
>
6
>
import { AgentSandboxEnabledValue } from '../../../sandbox/common/settings.js';
7
>
import { AgentHostSandboxKey, type ISandboxConfigValue } from '../../common/sandboxConfigSchema.js';
8
>
9
>
/**
10
>
* Whether the SDK sandbox is supported on Windows. Not enabled yet, so the
11
>
* builders bail out early on `win32`; the Windows handling is kept so support
12
>
* can be turned on by flipping this flag once the runtime is ready. Typed as
13
>
* `boolean` (not the `false` literal) so the Windows branches are not flagged
14
>
* as unreachable by control-flow narrowing.
15
>
*/
16
>
const WINDOWS_SANDBOX_SUPPORTED: boolean = false;
17
>
18
>
/**
19
>
* Per-platform filesystem rule bundle accepted under each `fileSystem.<os>`
20
>
* sub-key (`AgentHostSandboxKey.LinuxFileSystem` etc.) in the AgentHost root
21
>
* sandbox config bag. Mirrors the workbench's `chat.agent.sandbox.fileSystem.*`
22
>
* shape so the workbench-side forwarder can copy values verbatim.
23
>
*/
24
>
export interface IAgentSandboxFileSystemSetting {
25
>
allowRead?: string[];
26
>
allowWrite?: string[];
27
>
denyRead?: string[];
28
>
denyWrite?: string[];
29
>
}
30
>
31
>
/**
32
>
* SDK-side sandbox configuration produced by {@link buildSandboxConfigForSdk}.
33
>
*
34
>
* Structurally a narrowed form of the SDK's `SandboxConfig` type (from
35
>
* `@github/copilot-sdk`'s `SessionUpdateOptionsParams.sandboxConfig`) — the
36
>
* same shape the Copilot extension produces via its own `buildSandboxConfigForCLI`.
37
>
* Defined locally because `SandboxConfig` is not re-exported from the SDK's
38
>
* public entry point; this shape stays assignable to it.
39
>
*/
40
>
export interface ISdkSandboxConfig {
41
>
enabled: true;
42
>
allowBypass?: boolean;
43
>
userPolicy: {
44
>
filesystem: {
45
>
readwritePaths?: string[];
46
>
readonlyPaths?: string[];
47
>
deniedPaths?: string[];
48
>
};
49
>
network: {
50
>
allowOutbound: boolean;
51
>
allowedHosts?: string[];
52
>
blockedHosts?: string[];
53
>
};
54
>
};
55
>
}
56
>
57
>
/**
58
>
* Translate the AgentHost's host-side sandbox configuration into the
59
>
* opaque `sandboxConfig` shape the Copilot SDK forwards to the runtime
60
>
* via `session.options.update`.
61
>
*
62
>
* Used when {@link CopilotCliConfigKey.EnableCustomTerminalTool} is OFF — the
63
>
* SDK's built-in shell tool runs the user's commands, so we have to push the
64
>
* sandbox policy down into the SDK itself. When the custom terminal tool is
65
>
* ON, the AgentHost's own {@link TerminalSandboxEngine} wraps commands and
66
>
* this function is not consulted.
67
>
*
68
>
* Mirrors `buildSandboxConfigForCLI` in
69
>
* `extensions/copilot/src/extension/chatSessions/copilotcli/node/copilotcliSessionService.ts`
70
>
* so the two surfaces behave the same:
71
>
* - Path precedence: `denyRead` > `denyWrite` > `allowWrite` > `allowRead`.
72
>
* Each path appears in exactly one of `deniedPaths` / `readonlyPaths` /
73
>
* `readwritePaths`.
74
>
* - Network: `allowNetwork` opens outbound to everything and drops the
75
>
* allow/deny lists. Otherwise the allow/deny lists open outbound when
76
>
* set so they're actually enforced; host lists are currently disabled on
77
>
* all platforms (fail closed) because the runtime does not yet enforce
78
>
* them reliably everywhere.
79
>
*
80
>
* Windows is not supported yet, so this bails out early and returns `undefined`
81
>
* there. The Windows handling below is intentionally kept (and exercised when
82
>
* {@link WINDOWS_SANDBOX_SUPPORTED} is flipped) so support can be turned on once
83
>
* the runtime is ready.
84
>
*/
85
>
export function buildSandboxConfigForSdk(
86
platform: NodeJS.Platform,
87
sandbox: ISandboxConfigValue | undefined,