[Error Telemetry] Suppress UNC host access errors from Agents error reporting

[vs-code-engineering]

Error Message

unhandlederror-UNC host '192.165.54.12' access is not allowed. Please update the 'security.allowedUNCHosts' setting if you want to allow this host.

Stack Trace

    at i.create (./src/vs/platform/files/common/files.ts:834:0)
    at zr (./src/vs/platform/files/common/files.ts:846:0)
    at createFileSystemProviderError (./src/vs/platform/files/node/diskFileSystemProvider.ts:874:0)
    at i.stat (./src/vs/platform/files/node/diskFileSystemProvider.ts:97:0)

Raw Stack Trace (minified)

Unknown (FileSystemError): UNC host '192.165.54.12' access is not allowed. Please update the 'security.allowedUNCHosts' setting if you want to allow this host.     at i.create (out/main.js:414:34287)     at zr (out/main.js:414:32869)     at i.toFileSystemProviderError (out/main.js:435:27757)     at i.stat (out/main.js:435:19614)

Details

Property	Value
Bucket ID	3eef20c1-94d8-acd5-68fe-5ec86c27079e
Version	1.117.0-insider
Commit	98b4d3e2
Last Seen	Wed Apr 15 2026 02:32:52 GMT+0000 (Coordinated Universal Time)
Platforms	Windows
Product	Agents

---

This issue was automatically created from the VS Code Errors Dashboard

[vs-code-engineering]

🔍 Error Investigation

Summary

The diskFileSystemProvider.stat() method throws a FileSystemProviderError when a UNC path references a host not in the security.allowedUNCHosts allowlist. This is expected security behavior, not a bug — but the error is leaking into Agents error telemetry instead of being suppressed. The error has very low volume (2 hits, 1 user) and is isolated to Windows users accessing UNC paths without configuring the allowlist.

Culprit Commit

No culprit commit was identified. There is no regression commit range available, and this is not a code regression — it is a pre-existing gap in telemetry filtering. The UNC host access restriction is a long-standing security feature, and the error is reaching telemetry because the Agents product's error reporting path does not fully suppress FileSystemProviderError instances with code = 'Unknown'.

Code Flow

sequenceDiagram
    participant Caller as Caller (Agents)
    participant DiskFSP as DiskFileSystemProvider
    participant ToError as toFileSystemProviderError
    participant ErrorTelemetry as BaseErrorTelemetry

    Caller->>DiskFSP: stat(uncPath)
    DiskFSP->>DiskFSP: lstat(filePath)
    Note over DiskFSP: Node.js throws<br/>ERR_UNC_HOST_NOT_ALLOWED
    DiskFSP->>ToError: toFileSystemProviderError(error)
    Note over ToError: ⚠️ Root cause:<br/>Maps to FileSystemProviderErrorCode.Unknown<br/>instead of NoPermissions
    ToError-->>DiskFSP: FileSystemProviderError(code=Unknown)
    DiskFSP-->>Caller: throws FileSystemProviderError
    Note over Caller: Error not caught → unhandled
    Caller->>ErrorTelemetry: onUnexpectedError(err)
    Note over ErrorTelemetry: 💥 err.code check fails<br/>(code lost in IPC serialization)<br/>→ reported to telemetry

Loading

Affected Files

File	Role
src/vs/platform/files/node/diskFileSystemProvider.ts	Error origin — stat() throws; toFileSystemProviderError() maps ERR_UNC_HOST_NOT_ALLOWED to Unknown code
src/vs/platform/files/common/files.ts	FileSystemProviderError.create() — constructs the error with code
src/vs/platform/telemetry/common/errorTelemetry.ts	_onErrorEvent() — filter at line 110 checks err.code but may not see it when error crosses process boundaries
src/vs/base/common/errorMessage.ts	detectSystemErrorMessage() — also handles ERR_UNC_HOST_NOT_ALLOWED for display purposes

Repro Steps

1. Run VS Code Agents (Insiders) on Windows
2. Have a workspace or file reference that points to a UNC path (e.g., \\192.168.1.100\share\file.txt)
3. Do NOT add the UNC host IP to security.allowedUNCHosts setting
4. Trigger an operation that causes stat() on the UNC path (e.g., opening a file, resolving a path)
5. The FileSystemProviderError is thrown and reported to Agents error telemetry

Fix Proposal

Two-part fix recommended:

Fix 1 — Better error code (src/vs/platform/files/node/diskFileSystemProvider.ts → toFileSystemProviderError()):
Change the ERR_UNC_HOST_NOT_ALLOWED case from FileSystemProviderErrorCode.Unknown to FileSystemProviderErrorCode.NoPermissions. This is semantically correct (UNC host access denial is a permission/security check) and ensures the error carries a meaningful code that survives serialization and triggers appropriate handling upstream.

Fix 2 — Explicit telemetry filter (src/vs/platform/telemetry/common/errorTelemetry.ts → _onErrorEvent()):
Add a message-based filter for UNC host access errors, similar to the existing 'Unable to read file' filter at line 125. Check for err.message?.includes('UNC host') or err.message?.includes('security.allowedUNCHosts'). This provides defense-in-depth regardless of how the error arrives at the telemetry handler (with or without .code preserved).

Recommended Owner

@bryanchen-d — already assigned; owner of the error-telemetry area per working-areas.md. This is primarily a telemetry suppression issue.

Generated by errors-investigate · ● 7.3M · ◷

[bryanchen-d]

we should find the caller of the filesystem.stat() function to handle it instead of letting it throw.