Codex extension surfaced a renderer forced exit after hitting EMFILE on Linux
when a webview issued very large number of concurrent local resource fetches.
Diagnosis
- Codex extension can trigger roughly 625 concurrent webview resource requests.
- Webview resource loading currently forwards each request to the host and
begins transferring the returned body immediately.
- Disk reads are chunked at 256 KiB, and Mojo uses shared-memory FDs for
payloads above 64 KiB, so each in-flight resource body can consume file
descriptors in the renderer while it is being streamed.
- The sandboxed renderer runs with RLIMIT_NOFILE=1024 on Linux.
- This is not specific to codex extensionn, any extension with enough concurrent
resource bodies can accumulate to exhaust the renderer FD budget.
This makes the problem specifically about the number of simultaneously active
host-backed response bodies. A naive limiter around WebviewElement.loadResource()
would not address the root cause because loadResource() returns as soon as the
stream is transferred, while the FD pressure persists for the lifetime of the
stream in the renderer.
Introduce a service-worker-side global concurrency limit for host-backed webview
resource response bodies.
- Add a global limit of 32 active host-backed resource bodies in the webview
service worker.
- Acquire a permit before creating/posting the load-resource request so time
spent waiting for a slot does not consume the existing 30 second
RequestStore timeout.
- Hold the permit for the full lifetime of the returned ReadableStream, and
release it only when the stream reaches EOF, errors, or is cancelled.
- Release exactly once on all non-stream results and on every early/error path,
including timeout handling.
- Preserve existing range request behavior, ETag/304 handling, CacheStorage
behavior, Safari fallback streaming, and cancellation semantics.
- For cacheable responses, keep the permit until both source transfer and the
associated cache write complete, without delaying delivery of the response
back to the webview.
- Bump the service worker version and WebviewElement expected version together
so clients pick up the updated worker.
Tests
- Add an API integration regression test that creates a webview, materializes
many local resources, fetches them concurrently from inside the webview, and
verifies the webview stays alive and all loads complete.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Default editor and panel chat to Agent Host Copilot when the agent host is enabled
Builds on the chat.editor.preferCopilotHarness behavior to make Agent Host
Copilot the computed default chat provider for both editor and panel chat
whenever the agent host is enabled, so first-time users land on Copilot instead
of Local. chat.editor.preferCopilotHarness stays scoped to the one-time
Local -> Copilot migration only.
- Thread an agentHostEnabled flag (from IAgentHostEnablementService) through the
default-session-type resolution and its callers.
- Keep Local visible and selectable; honor explicit and remembered selections.
- New Local Chat opens a local session directly: it cancels the in-flight
default-provider resolution (which would otherwise block on agent host
activation) so the local request wins immediately.
- Open a Local chat first in all chat participant API tests, since chat
participants are a Local-harness feature.
- Add a smoketest.openLocalChat command for Local panel smoke scenarios; the
sandbox reopen path reveals the existing local session to avoid a focus race.
- Register an IAgentHostEnablementService stub in the component fixtures.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chat: honor resolved session type when starting a new chat
Fixes the New Chat drop bug (review comment #2 on #326086): when the
agent host is enabled the computed default is a non-local harness, so the
editor clear path recomputed that default and dropped explicit or
preserved local requests.
- clearChatSessionPreservingType now branches on the resolved session
type for the sidebar (non-local -> loadSession, local ->
startNewLocalSession) so a generic New Chat from a Local panel
preserves Local, consistent with contributed panels.
- The resolved type is threaded through IChatWidget.clear ->
viewOptions.clear -> chatEditor.clear -> clearChatEditor so the editor
opens a session of that type instead of recomputing the default. This
restores explicit "New Local Chat" from a non-local editor.
- clearChatEditor applies an explicit target type directly and keeps its
swap-aware default only for direct (untargeted) calls.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* chat: cancel the previous applyModel resolution before replacing it
Assigning a new CancellationTokenSource to the MutableDisposable only
disposes the previous source, and disposing a CancellationTokenSource
does not cancel it. So a re-entrant applyModel() (view render, switch
session) left the prior in-flight resolution running, racing to call
showModel with a stale result. Cancel the previous source explicitly
before replacing it.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
vscode-api-tests: use explicit "types" instead of "typeRoots"
Switches tsconfig from typeRoots-only (which only auto-includes @types/* found at the literal path ./node_modules/@types) to an explicit "types" list. Explicit types resolve via Node module resolution, so they keep working regardless of whether npm hoists @types/node to the workspace root or keeps it extension-local.
Refs microsoft/vscode-engineering#2912 — the recurring TS2591 "Cannot find name 'process'" failure on the build agent after #319389 changed the lockfile is consistent with @types/node being hoisted to a path the typeRoots-only config can't see. Matches the pattern already used by extensions/github, extensions/copilot, etc.
* adding allowRead and testing with defaults
* Rename terminal sandbox read allow list
* Remove Copilot settings change from sandbox PR
* changes
* changes
* Updating sandbox runtime package
* Updating tests
* Add macOS test cases for denyRead/allowRead behavior and ~ path handling
Agent-Logs-Url: https://github.com/microsoft/vscode/sessions/ec5cf3c2-6c7b-4577-bdbb-8ac3d42bdfb0
Co-authored-by: dileepyavan <52841896+dileepyavan@users.noreply.github.com>
* changes for readonly home dir
* skipping integrated tests for sandbox
* running srt in tmp_dir for linux
* running srt in tmp_dir for linux
* skipping failed integration test in linux
* fixing test failures
* fixing test failures
* skipping integration tests in CI pipeline
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* adding allowRead and testing with defaults
* Rename terminal sandbox read allow list
* Remove Copilot settings change from sandbox PR
* changes
* changes
* Updating sandbox runtime package
* Updating tests
* Add macOS test cases for denyRead/allowRead behavior and ~ path handling
Agent-Logs-Url: https://github.com/microsoft/vscode/sessions/ec5cf3c2-6c7b-4577-bdbb-8ac3d42bdfb0
Co-authored-by: dileepyavan <52841896+dileepyavan@users.noreply.github.com>
* changes for readonly home dir
* skipping integrated tests for sandbox
* running srt in tmp_dir for linux
* running srt in tmp_dir for linux
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* Rename sandbox setting to chat.agent.sandbox (#303421)
Rename the top-level sandbox setting from `chat.tools.terminal.sandbox.enabled`
to `chat.agent.sandbox` to reflect that sandboxing is a general agent concept,
not terminal-specific.
- Update setting ID value to `chat.agent.sandbox`
- Update description to be more general
- Deprecate old `chat.tools.terminal.sandbox.enabled` setting
- Update telemetry event name
Fixes#303421
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updating terminal sandbox to agent sandbox
* removed allowTrustedDomains
* correcting the settings keys for sandboxing
* correcting the settings keys for sandboxing
* Explicit notification for blocked domains before running the command
* Fix terminal sandbox follow-ups
* main merge
* fixing tests
* Update src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/runInTerminalTool.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Revert "Update src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts"
This reverts commit b956dfa719.
* removing local files
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Rename sandbox setting to chat.agent.sandbox (#303421)
Rename the top-level sandbox setting from `chat.tools.terminal.sandbox.enabled`
to `chat.agent.sandbox` to reflect that sandboxing is a general agent concept,
not terminal-specific.
- Update setting ID value to `chat.agent.sandbox`
- Update description to be more general
- Deprecate old `chat.tools.terminal.sandbox.enabled` setting
- Update telemetry event name
Fixes#303421
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* updating terminal sandbox to agent sandbox
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: command rewriting issues when terminal sandboxing is enabled
Fixes two issues with sandboxed terminal commands:
1. Sandboxed commands end up in shell history (#303769): The
PreventHistoryRewriter was running before SandboxRewriter, so the
leading space was applied to the inner command but not the final
sandbox-wrapped command. Moved PreventHistoryRewriter to run last.
2. cd CWD prefix not stripped in sandbox mode (#303848): The
SandboxedCommandLinePresenter was using the original (un-rewritten)
command for display, bypassing cd prefix stripping. Changed to use
forDisplay instead.
3. Fixed forDisplay being clobbered: The rewriter loop unconditionally
overwrote forDisplay, so later rewriters without a forDisplay
(like PreventHistoryRewriter) would clear the sandbox's display
value. Changed to only update when explicitly provided.
Fixes#303769Fixes#303848
* update doc comment for SandboxedCommandLinePresenter
* improve execute strategy logging for CI diagnostics
Upgrade strategy selection and completion logs to info level in
runInTerminalTool. In richExecuteStrategy, log at info level when
running in CI (for diagnosing shell integration race conditions)
and debug otherwise.
* fix: include ignorespace in bash shell integration history verification
When VSCODE_PREVENT_SHELL_HISTORY=1 is set (which it is for all tool
terminals created by the run_in_terminal tool), the bash shell
integration script sets HISTCONTROL="ignorespace" (line 67). This
causes bash to exclude space-prefixed commands from history.
Later in the same script (line 200), a regex decides whether to use
`history 1` or $BASH_COMMAND to capture the current command in
__vsc_preexec. The regex checks for erasedups, ignoreboth, and
ignoredups — but NOT ignorespace. This is a bug because:
1. The same script sets HISTCONTROL=ignorespace 130 lines earlier
2. ignoreboth (which IS in the regex) is defined by bash as
"ignorespace + ignoredups" — so the compound form was handled
but the simple form was not
The consequence: with HISTCONTROL=ignorespace and __vsc_history_verify=1,
__vsc_preexec calls `history 1` to get the current command. But the
command has a leading space (added by PreventHistoryRewriter), so bash
history never recorded it. `history 1` returns the PREVIOUS command
or nothing. This causes __vsc_current_command to be wrong or empty.
In __vsc_command_complete, when __vsc_current_command is empty, the
script sends the OSC sequence 633;D WITHOUT an exit code (line 373).
The VS Code side then receives onCommandFinished with exitCode=undefined,
breaking exit code detection for ALL tool terminal commands on bash.
The fix adds ignorespace to the existing regex, so bash falls back to
$BASH_COMMAND (which always works regardless of history settings).
This matches the behavior already provided when ignoreboth is set.
* docs: improve fix-ci-failures skill with faster log retrieval workflow
- setupRecreatingStartMarker returns IDisposable to stop marker recreation
before sending commands (prevents marker jumping on PSReadLine re-renders)
- noneExecuteStrategy waits for cursor to move past start line after sendText
before starting idle detection (prevents end marker at same line as start)
- findCommandEcho supports suffix matching for partial command echoes from
wrapped getOutput() results (shell integration ON with long commands)
- Suffix matching requires mid-word split to avoid false positives on output
that happens to be a suffix of the command (e.g. echo output)
- Integration tests: use ; separator on Windows, add && conversion test,
handle Windows exit code quirks with cmd /c
- Handle /usr/bin/bash (Linux) vs /bin/bash (macOS) in /tmp write test
- Handle 'Read-only file system' (Linux) vs 'Operation not permitted' (macOS)
- Add 'Read-only file system' to outputLooksSandboxBlocked heuristic
- Replace newlines with spaces (not empty) to handle terminal wrapping
- Extract outputLooksSandboxBlocked as exported function with unit tests
- Add bubblewrap and socat to Linux CI apt-get install
- Make sandbox test assertions platform-aware (macFileSystem vs linuxFileSystem)
- Make /etc/shells test accept both macOS and Linux first-line format
- Broaden wrapped prompt fragment regex to handle path chars (ts/testWorkspace$)
- Fix continuation pattern to match user@host:path wrapped lines
- Apply stripCommandEchoAndPrompt to getOutput() in BasicExecuteStrategy
(basic shell integration lacks reliable 133;C markers so getOutput()
can include command echo)
- Keep RichExecuteStrategy getOutput() unstripped (rich integration
has reliable markers)
Kyle CutlerandGitHub
Alex RossandGitHub
Bryan ChenandGitHub
Megan RoggeandGitHub
Johannes
Matt Bierner
João MorenoandGitHub
Dmitriy VasyuraandGitHub
Christof Marti
Anthony KimandGitHub
Alexandru DimaandGitHub
Alex Dima