[cherry-pick] [release/1.121] Allow sandbox writes to workspace storage

[dileepyavan]

Summary

• allow terminal sandbox writes to the workspace storage folder
• preserve the refactored shared TerminalSandboxEngine architecture
• document the workspace storage write root across Linux, macOS, and Windows settings

Validation

• terminalSandboxService.test.ts: 62 passed, 0 failed

[vs-code-engineering]

📬 CODENOTIFY

The following users are being notified based on files changed in this PR:

@anthonykim1

Matched files:

• src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts
• src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/terminalSandboxService.test.ts

[Copilot]

Pull request overview

This cherry-pick updates terminal sandboxing so the workspace storage directory is treated as a writable root (in addition to being readable), aligning behavior with the intended TerminalSandboxEngine host-provided workspace/session storage location.

Changes:

• Add the workspace storage root to the sandbox filesystem write allow-list.
• Update Windows filesystem setting text to explicitly mention the workspace storage folder as an allowed write root.
• Extend the terminal sandbox service test to assert workspace storage is included in allowWrite.

Show a summary per file

File	Description
src/vs/workbench/contrib/terminalContrib/chatAgentTools/test/browser/terminalSandboxService.test.ts	Adds an assertion that workspace storage is included in allowWrite.
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts	Updates Windows allowWrite setting description to mention workspace storage.
src/vs/platform/sandbox/common/terminalSandboxEngine.ts	Includes workspace storage path in computed write roots (and adjusts async flow accordingly).

Copilot's findings

Comments suppressed due to low confidence (1)

src/vs/platform/sandbox/common/terminalSandboxEngine.ts:74

• getWorkspaceStorageReadRoot is now used to grant write access (and the JSDoc mentions allowWrite), so the method name is misleading. Consider renaming it (and related references like onDidChangeRoots docs) to something like getWorkspaceStorageRoot / getWorkspaceStorageAccessRoot to reflect its read+write semantics and avoid future confusion.

	/** Path added to `allowRead` and `allowWrite` for the engine's workspace/session storage area. */
	getWorkspaceStorageReadRoot(): Promise<URI | undefined>;
	/** Roots that must be writable inside the sandbox (workspace folders / session cwds). */
	getWriteRoots(): readonly URI[];
	/** Fires when {@link getWriteRoots} or {@link getWorkspaceStorageReadRoot} change. */
	readonly onDidChangeRoots: Event<void>;

• Files reviewed: 3/3 changed files
• Comments generated: 0