[Error] unhandlederror-Cannot read properties of undefined (reading 'scheme')

[vs-code-engineering]

Error Message

unhandlederror-Cannot read properties of undefined (reading 'scheme')

Stack Trace

    at cpe (./src/vs/platform/workspace/common/virtualWorkspace.ts:11:17)
    at isVirtualResource (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:449:9)
    at $_e.doGetUriTrustInfo (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:376:11)
    at $_e.getUrisTrust (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:354:28)
    at $_e.calculateWorkspaceTrust (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:326:14)
    at $_e.updateWorkspaceTrust (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:336:18)
    at async $_e.saveTrustInfo (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:281:2)
    at async $_e.doSetUrisTrust (./src/vs/workbench/services/workspaces/common/workspaceTrust.ts:431:3)

Raw Stack Trace (minified)

TypeError: Cannot read properties of undefined (reading 'scheme')     at cpe (out/vs/sessions/sessions.desktop.main.js:932:97362)     at $_e.isTrustedVirtualResource (out/vs/sessions/sessions.desktop.main.js:954:8633)     at $_e.doGetUriTrustInfo (out/vs/sessions/sessions.desktop.main.js:954:7534)     at $_e.getUrisTrust (out/vs/sessions/sessions.desktop.main.js:954:7247)     at $_e.calculateWorkspaceTrust (out/vs/sessions/sessions.desktop.main.js:954:6834)     at $_e.updateWorkspaceTrust (out/vs/sessions/sessions.desktop.main.js:954:7027)     at async $_e.saveTrustInfo (out/vs/sessions/sessions.desktop.main.js:954:6130)     at async $_e.doSetUrisTrust (out/vs/sessions/sessions.desktop.main.js:954:8376)

Details

Property	Value
Bucket ID	7cd78850-b32c-4ed3-725a-93a27bd3a508
Version	1.117.0-insider
Commit	98b4d3e2
Last Seen	Thu Apr 16 2026 18:01:59 GMT+0000 (Coordinated Universal Time)
Platforms	Mac, Windows
Product	Agents

---

This issue was automatically created from the VS Code Errors Dashboard

[vs-code-engineering]

🔍 Error Investigation

Summary

The error Cannot read properties of undefined (reading 'scheme') occurs because the CanonicalWorkspace.folders getter uses index-based lookup between the live originalWorkspace.folders array and a snapshot canonicalFolderUris array. When workspace folders change during the async resolveCanonicalUris() operation (which contains an await Promise.all), the arrays become misaligned, producing undefined URIs that crash when isVirtualResource() accesses .scheme. This is triggered specifically in the Agents product when manageTrustWorkspaceForSession() calls setUrisTrust() while workspace folders are being added/removed for agent sessions.

Culprit Commit

No single culprit commit was identified. The root cause is a pre-existing TOCTOU race condition in resolveCanonicalUris() (introduced when the CanonicalWorkspace pattern was first created). The race became triggerable in the Agents product due to the combination of:

1. WorkspaceFolderManagementContribution dynamically adding/removing workspace folders when sessions change
2. manageTrustWorkspaceForSession() calling setUrisTrust() which triggers resolveCanonicalUris() concurrently with folder mutations

The error first appeared in 1.117.0-insider builds (commits 98b4d3e2, 863765d4, 4ab3ca55) around April 15-16, 2026. Recent changes to agent session workspace handling (worktree management, working sets, permission centralization) likely altered timing enough to trigger this latent race.

Code Flow

sequenceDiagram
    participant WFM as WorkspaceFolderManagement
    participant WTM as WorkspaceTrustMgmt
    participant CW as CanonicalWorkspace
    participant VW as virtualWorkspace

    WFM->>WTM: setUrisTrust([worktree], true)
    WTM->>WTM: doSetUrisTrust() → saveTrustInfo()
    WTM->>WTM: updateWorkspaceTrust()
    WTM->>WTM: resolveCanonicalUris()
    Note over WTM: Captures N folder URIs
    WTM->>WTM: await Promise.all(canonicalize)
    Note over WFM: ⚠️ Workspace folders change<br/>(add/remove during await)
    WTM->>CW: new CanonicalWorkspace(workspace, N canonical URIs)
    Note over CW: workspace now has N+1 folders<br/>but only N canonical URIs
    WTM->>WTM: calculateWorkspaceTrust()
    WTM->>CW: getWorkspaceUris() → folders.map(f => f.uri)
    Note over CW: ⚠️ canonicalFolderUris[N] = undefined
    WTM->>WTM: doGetUriTrustInfo(undefined)
    WTM->>VW: isVirtualResource(undefined)
    Note over VW: 💥 undefined.scheme throws<br/>TypeError

Loading

Affected Files

File	Role
src/vs/workbench/services/workspaces/common/workspaceTrust.ts	Root cause — CanonicalWorkspace class (line 37-67) and resolveCanonicalUris() (line 217-249)
src/vs/platform/workspace/common/virtualWorkspace.ts	Crash site — isVirtualResource() at line 11
src/vs/sessions/contrib/workspace/browser/workspaceFolderManagement.ts	Trigger — manageTrustWorkspaceForSession() calls setUrisTrust while also managing folders

Repro Steps

1. Open the Agents application (VS Code Insiders with Agents product)
2. Start or switch between agent sessions that have worktrees (requiresWorkspaceTrust: true)
3. The error is a race condition — it occurs when setUrisTrust() triggers resolveCanonicalUris() at the same moment that workspace folders are being added/removed for the session
4. More likely to trigger with rapid session switching or when multiple async operations (trust setting + folder management) overlap

Fix Proposal

Fix location: src/vs/workbench/services/workspaces/common/workspaceTrust.ts → resolveCanonicalUris() and CanonicalWorkspace

Approach: The fix should ensure the folder snapshot used for canonical URI resolution is the same snapshot used when constructing the CanonicalWorkspace. Two options:

1. Snapshot the folders at capture time (recommended): At line 248, instead of calling this.workspaceService.getWorkspace() again (which may return updated folders), use the same workspace/folders that were captured at line 240. This could mean passing the captured workspaceUris to CanonicalWorkspace or re-reading at a single point.

2. Guard against undefined URIs: Add a defensive check in getWorkspaceUris() to filter out undefined entries: this._canonicalWorkspace.folders.map(f => f.uri).filter(Boolean). This is a safety net but doesn't fix the underlying desync.

3. Snapshot the workspace object: Store the workspace object from line 240 in a local variable and reuse it at line 248 instead of calling getWorkspace() again. This prevents the CanonicalWorkspace from seeing a different folder count than the canonical URIs were resolved for.

Option 1 or 3 addresses the root cause; option 2 is a defensive fallback. Both could be applied together.

Recommended Owner

@lszomoru — Workspace Trust area owner per working-areas.md, and author of the original CanonicalWorkspace pattern and agent sessions trust integration (PR #290348)

Generated by errors-investigate · ● 17.5M · ◷