Flatten sandbox network settings

[alexdima]

Split the nested chat.tools.terminal.sandbox.network object setting into three flat settings:

• chat.tools.terminal.sandbox.network.allowedDomains
• chat.tools.terminal.sandbox.network.deniedDomains
• chat.tools.terminal.sandbox.network.allowTrustedDomains

Add configuration migration to automatically migrate existing values. The old setting is preserved as deprecated with a pointer to the new ones.

Fixes #304232

[Copilot]

Pull request overview

This PR flattens the terminal sandbox network configuration from a single nested object setting into three separate settings, and introduces a configuration migration to automatically move existing user values over while keeping the legacy key deprecated for compatibility.

Changes:

• Replace chat.tools.terminal.sandbox.network with three flat settings for allowed domains, denied domains, and trusted-domain inclusion.
• Update terminal sandbox runtime/config consumers and related tool messaging to use the new setting IDs.
• Add a configuration migration that splits old object values into the new keys and clears the deprecated setting.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/electron-browser/runInTerminalTool.test.ts	Updates a config-change test to target the new allowed-domains key.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/terminalSandboxService.test.ts	Updates sandbox service tests to use the new flattened keys.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts	Switches runtime reads and change detection from the nested object to the three flat settings.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandbox.ts	Removes now-unused network/settings interfaces formerly tied to the nested object setting.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts	Defines the new settings and introduces a deprecated placeholder for the legacy key.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/tools/sandboxOutputAnalyzer.ts	Updates guidance text to reference the new allowed-domains setting ID.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/browser/terminal.chatAgentTools.contribution.ts	Updates re-registration triggers to watch the new keys.
src/vs/workbench/contrib/terminal/terminalContribExports.ts	Exposes new (and deprecated) setting IDs for other terminal layers.
src/vs/workbench/contrib/terminal/common/terminalConfiguration.ts	Registers a configuration migration to split the legacy object into the new flat settings.

Comments suppressed due to low confidence (1)

src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalSandboxService.ts:196

• Reading only the new flattened settings here means existing user configs that still use the deprecated object key (chat.tools.terminal.sandbox.network) will be treated as “no allowed domains” until the configuration migration has executed. Because configuration migrations are applied by a workbench contribution (registered at a later phase), there can be a window where the sandbox runs with the wrong network rules. Consider falling back to reading the deprecated object value when the new keys are unset, so behavior is correct even before/without migration.

			const allowedDomainsSetting = this._configurationService.getValue<string[]>(TerminalChatAgentToolsSettingId.TerminalSandboxNetworkAllowedDomains) ?? [];
			const deniedDomainsSetting = this._configurationService.getValue<string[]>(TerminalChatAgentToolsSettingId.TerminalSandboxNetworkDeniedDomains) ?? [];
			const allowTrustedDomains = this._configurationService.getValue<boolean>(TerminalChatAgentToolsSettingId.TerminalSandboxNetworkAllowTrustedDomains) ?? false;