Don't route terminal secret prompts through vscode_askQuestions#314258
Merged
Conversation
Agent-Logs-Url: https://github.com/microsoft/vscode/sessions/9f66acd2-1929-46f2-9e20-013a5fe79bc4 Co-authored-by: meganrogge <29464607+meganrogge@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix handling of sensitive inputs in ask question tool
Don't route terminal secret prompts through vscode_askQuestions
May 4, 2026
meganrogge
approved these changes
May 4, 2026
meganrogge
approved these changes
May 4, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the model-facing guidance strings for the terminal chat agent tools to ensure that secret prompts (passwords/passphrases/tokens/API keys) are not routed through vscode_askQuestions, since answers provided to that tool flow through the model endpoint. Instead, the model is instructed to tell the user to type secrets directly into the terminal and stop.
Changes:
- Updated PowerShell and bash/generic tool descriptions to explicitly forbid collecting secrets via
vscode_askQuestions. - Refined
_buildInputNeededSteeringText(default mode) to scopevscode_askQuestionsusage to non-secret prompts and added an explicit prohibition for secret prompts. - Updated JSDoc to reflect the new “non-secret only” contract for
vscode_askQuestions.
Show a summary per file
| File | Description |
|---|---|
| src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/runInTerminalTool.ts | Updates model-facing prompt strings and JSDoc to prevent secret prompts from being collected via vscode_askQuestions, instructing users to type secrets directly into the terminal. |
Copilot's findings
Comments suppressed due to low confidence (1)
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/runInTerminalTool.ts:232
- This bullet refers to
send_to_terminalas a literal string, but nearby lines reference tool IDs via${TerminalToolId.*}. Using${TerminalToolId.SendToTerminal}here would keep the description consistent and avoid hardcoding the tool ID in multiple places.
- NEVER use vscode_askQuestions to request sensitive input such as passwords, passphrases, API keys, tokens, or other secrets — answers to that tool are sent through the model. If the prompt requires a secret, tell the user to type it directly into the terminal and stop; do not call vscode_askQuestions or send_to_terminal for that prompt.
- Files reviewed: 1/1 changed files
- Comments generated: 1
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
meganrogge
approved these changes
May 4, 2026
Contributor
Screenshot ChangesBase: Changed (5)Errored (18)Fixtures that failed to render — no screenshot was produced.
|
rzhao271
approved these changes
May 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
run_in_terminaldetected an interactive prompt (e.g.[sudo] password:), the steering text told the model to callvscode_askQuestionsto collect the answer. Answers to that tool flow through the model endpoint, so users had no way to enter passwords/passphrases/tokens that stayed local to the terminal.Description
Updated the model-facing prompt strings in
runInTerminalTool.tsto forbid routing secret prompts throughvscode_askQuestions. For secret prompts the model is instructed to tell the user to type the value directly into the terminal and stop._buildInputNeededSteeringText(default mode): droppedpassword:from the example list, narrowed to "non-secret input prompt", and appended an explicit prohibition for secrets. Auto-approve branch already handled this correctly.vscode_askQuestions._buildInputNeededSteeringTextupdated to reflect the new contract.No logic changes; prompt-string only.