doc updates for 1.129.0

docs/agents/approvals.md

@@ -198,18 +198,18 @@ For an overview of how sandboxing works, what it protects against, and OS-level
 
 Agent sandboxing restricts file system and network access for commands executed by the agent, including Copilot CLI agent-host sessions that use the VS Code agent terminal integration. When sandboxing is enabled, terminal commands that run inside the sandbox are auto-approved without requiring user confirmation, because they run in a controlled environment.
 
-Agent terminal sandboxing is available on macOS, Linux, and Windows. On Windows, VS Code uses the MXC runtime (`wxc-exec.exe`).
+Agent terminal sandboxing is available on macOS and Linux, including WSL2 environments.
 
 Sandbox enablement and unrestricted network access are configured independently:
 
-* **Sandbox enablement** controls whether agent terminal commands run in the sandbox. On macOS and Linux, use `setting(chat.agent.sandbox.enabled)`. On Windows, use `setting(chat.agent.sandbox.enabledWindows)`. Both settings accept the following values:
+* **Sandbox enablement** controls whether agent terminal commands run in the sandbox. On macOS and Linux, use `setting(chat.agent.sandbox.enabled)`, which accepts the following values:
 
     | Value | Description |
     |-------|-------------|
     | `off` (default) | Sandboxing is disabled. |
     | `on` | Sandboxing is enabled with file system and network isolation. All outbound network access is blocked unless domains are explicitly allowed. |
 
-    The **Sandboxing for terminal** checkbox in the permission picker maps its checked state to these values and updates the setting that applies to your operating system.
+    The **Sandboxing for terminal** checkbox in the permission picker maps its checked state to these values and updates the setting.
 
 * **Unrestricted network access** controls whether sandboxed commands can reach any network domain. Set `setting(chat.agent.sandbox.allowNetwork)` to `true` to permit all outbound network traffic while keeping file system restrictions in effect. This setting applies only when sandboxing is enabled and defaults to `false`.
 
@@ -236,7 +236,7 @@ Because the agent attempts the command inside the sandbox first and only surface
 
 ### Configure file system access
 
-Use the platform-specific file system sandbox setting to control file system access: `setting(chat.agent.sandbox.fileSystem.mac)` on macOS, `setting(chat.agent.sandbox.fileSystem.linux)` on Linux, and `setting(chat.agent.sandbox.fileSystem.windows)` on Windows.
+Use the platform-specific file system sandbox setting to control file system access: `setting(chat.agent.sandbox.fileSystem.mac)` on macOS and `setting(chat.agent.sandbox.fileSystem.linux)` on Linux and WSL2.
 
 You can specify allow rules for read and write access, and deny rules for both read and write access. These rules don't support glob patterns. The `denyWrite` and `denyRead` rules take precedence over `allowWrite` and `allowRead` rules.
 

docs/agents/concepts/trust-and-safety.md

@@ -90,7 +90,7 @@ Without file system isolation, a compromised command could modify files anywhere
 
 Without network isolation, a compromised command could exfiltrate sensitive data or could perform unintended actions on external services. Network isolation prevents this by blocking all outbound connections by default.
 
-Sandbox enablement and unrestricted network access are separate controls. When sandboxing is enabled and `setting(chat.agent.sandbox.allowNetwork)` is off, all outbound network access is blocked unless you explicitly allow specific domains. When `setting(chat.agent.sandbox.allowNetwork)` is on, commands can reach external services freely while file system restrictions still apply. Sandbox enablement uses `setting(chat.agent.sandbox.enabled)` on macOS and Linux, and `setting(chat.agent.sandbox.enabledWindows)` on Windows; both accept `off` (default) or `on`.
+Sandbox enablement and unrestricted network access are separate controls. When sandboxing is enabled and `setting(chat.agent.sandbox.allowNetwork)` is off, all outbound network access is blocked unless you explicitly allow specific domains. When `setting(chat.agent.sandbox.allowNetwork)` is on, commands can reach external services freely while file system restrictions still apply. On macOS and Linux, `setting(chat.agent.sandbox.enabled)` controls sandbox enablement and accepts `off` (default) or `on`.
 
 VS Code provides network domain filtering that applies to both agent tools (fetch tool, integrated browser) and sandboxed terminal commands. Enable `setting(chat.agent.networkFilter)` to activate network filtering. Use `setting(chat.agent.allowedNetworkDomains)` and `setting(chat.agent.deniedNetworkDomains)` to control which domains the agent can access. Learn how to [configure network access](/docs/agents/approvals.md#configure-network-access).
 
@@ -111,7 +111,6 @@ Agent sandboxing relies on OS-level security primitives to enforce file system a
 |----------|-----------|---------------|
 | macOS | Apple's sandboxing framework ("Seatbelt"), built into the operating system. Enforces fine-grained file system and network restrictions at the kernel level. | None. Works out of the box. |
 | Linux and WSL2 | [bubblewrap](https://github.com/containers/bubblewrap) for file system isolation and `socat` for network proxying. | Install required packages: `sudo apt-get install bubblewrap socat` (Debian and Ubuntu) or `sudo dnf install bubblewrap socat` (Fedora). |
-| Windows | MXC runtime (`wxc-exec.exe`) for sandboxed agent terminal commands. | The MXC runtime must be available. |
 
 WSL version 1 is not supported because bubblewrap requires Linux kernel features (user namespaces) that are only available in WSL2.
 

docs/agents/security.md

@@ -26,7 +26,7 @@ Use the following checklist to set up a secure starting point for AI-assisted de
 
 1. **Open untrusted projects in restricted mode.** Until you've reviewed a project for malicious content, rely on the [Workspace Trust](#trust-boundaries) boundary. Restricted mode disables agents in that workspace.
 
-1. **Enable agent sandboxing.** On macOS, Linux, and Windows, enable agent sandboxing to restrict file system and network access for agent-executed commands. Use `setting(chat.agent.sandbox.enabled)` on macOS and Linux, and `setting(chat.agent.sandbox.enabledWindows)` on Windows. Learn more about [agent sandboxing](#agent-sandboxing-preview).
+1. **Enable agent sandboxing.** On macOS and Linux, including WSL2 environments, enable `setting(chat.agent.sandbox.enabled)` to restrict file system and network access for agent-executed commands. Learn more about [agent sandboxing](#agent-sandboxing-preview).
 
 1. **Review all file edits before accepting.** Use the [diff editor](/docs/chat/review-code-edits.md) to inspect proposed changes. Keep or undo individual changes before they are applied.
 
@@ -93,7 +93,7 @@ Learn more about [tool and command approval](/docs/agents/approvals.md#tool-appr
 
 Agent sandboxing uses OS-level isolation to restrict what agent-executed processes can access on your machine. Rather than relying solely on approval prompts, sandboxing enforces strict file system and network boundaries at the kernel level, so commands cannot access resources outside the permitted scope, even if they are approved. For a deeper look at how sandboxing works and the OS-level enforcement details, see [Agent sandboxing](/docs/agents/concepts/trust-and-safety.md#agent-sandboxing).
 
-Agent terminal sandboxing is available on macOS, Linux, and Windows. On Windows, VS Code uses the MXC runtime (`wxc-exec.exe`). The same sandboxing applies to Copilot CLI agent-host sessions that run commands through the VS Code agent terminal integration.
+Agent terminal sandboxing is available on macOS and Linux, including WSL2 environments. The same sandboxing applies to Copilot CLI agent-host sessions that run commands through the VS Code agent terminal integration.
 
 > [!IMPORTANT]
 > Agent sandboxing is the strongest protection against malicious terminal commands. If prompt injection is a concern, use agent sandboxing or run VS Code in a [dev container](/docs/devcontainers/containers.md) instead of relying on auto-approval rules alone. Auto-approval rules use best-effort command parsing and have known limitations with shell aliases, quote concatenation, and complex shell syntax.

docs/enterprise/ai-settings.md

@@ -248,11 +248,16 @@ Organizations should recommend that developers enable [agent sandboxing](/docs/a
 
 The `ChatAgentSandboxEnabled` policy controls whether agent sandboxing is enabled or disabled. This configures the `setting(chat.agent.sandbox.enabled)` setting in VS Code.
 
-When set to `true`, agent-executed terminal commands run inside a sandbox environment with restricted permissions. When set to `false`, no sandbox is applied.
+Set the policy to `on` to run agent-executed terminal commands inside a sandbox environment with restricted permissions. Set the policy to `off` to disable the sandbox.
+
+The following policies control whether a sandboxed command can relax these restrictions:
+
+* Set `ChatAgentSandboxAllowNetwork` to `false` to apply the configured network domain rules to sandboxed commands.
+* Set `ChatAgentSandboxAllowUnsandboxedCommands` to `false` to prevent commands from running outside the sandbox after user confirmation.
 
 ## Configure agent network filtering
 
-Network filtering restricts which domains agent tools (fetch tool, integrated browser) can access during chat sessions. When enabled, agents can only reach domains that are explicitly allowed by the configured domain lists.
+Network filtering restricts which domains the fetch tool and integrated browser can access during chat sessions. When agent sandboxing is enabled, the same domain rules also apply to agent-executed terminal commands.
 
 ### Enable network filtering
 
@@ -262,17 +267,30 @@ When the policy is set to `true`, network access by agent tools is restricted ac
 
 When both domain lists are empty and the filter is enabled, all network access by agent tools is blocked.
 
+To deny network access by default for the fetch tool, integrated browser, and sandboxed terminal commands, configure these policies:
+
+| Policy | Value |
+|--------|-------|
+| `ChatAgentNetworkFilter` | `true` |
+| `ChatAgentSandboxEnabled` | `on` |
+| `ChatAgentAllowedNetworkDomains` | Empty list |
+| `ChatAgentSandboxAllowNetwork` | `false` |
+| `ChatAgentSandboxAllowUnsandboxedCommands` | `false` |
+
+> [!IMPORTANT]
+> The `setting(chat.agent.sandbox.retryWithAllowNetworkRequests)` setting defaults to `true`. It enables a sandboxed terminal command to retry with unrestricted network access after user confirmation. This setting does not currently have an enterprise policy, so administrators cannot enforce its value through VS Code policy.
+
 ### Configure allowed domains
 
 The `ChatAgentAllowedNetworkDomains` policy controls which domains agent tools are permitted to access. This configures the `setting(chat.agent.allowedNetworkDomains)` setting in VS Code.
 
-Provide a list of domain patterns. Wildcards are supported, for example `*.example.com`. When [agent sandboxing](/docs/agents/concepts/trust-and-safety.md#agent-sandboxing) is also enabled, these domain rules additionally apply to terminal commands executed by the agent.
+Provide a list of domain patterns. Wildcards are supported, for example `*.example.com`. An empty list blocks all domains when network filtering or agent sandboxing is enabled.
 
 ### Configure denied domains
 
 The `ChatAgentDeniedNetworkDomains` policy controls which domains agent tools are blocked from accessing. This configures the `setting(chat.agent.deniedNetworkDomains)` setting in VS Code.
 
-Denied domains always take precedence over allowed domains. Wildcards are supported, for example `*.example.com`.
+Use this policy to block exceptions to the allowed domain list. Denied domains always take precedence over allowed domains. Wildcards are supported, for example `*.example.com`. You do not need to specify denied domains when the allowed domain list is empty because all domains are already blocked.
 
 ## Configure Copilot code review
 

release-notes/v1_128.md

@@ -17,6 +17,8 @@ Follow us on [LinkedIn](https://www.linkedin.com/showcase/vs-code), [X](https://
 
 _Release date: July 8, 2026_
 
+**Update 1.128.1**: The update addresses these [security issues](https://github.com/microsoft/vscode/issues?q=is%3Aissue+is%3Aclosed+milestone%3A1.128.1).
+
 <!-- DOWNLOAD_LINKS_PLACEHOLDER -->
 
 ---