From d2904341a4bb81d6d3b853c82589b26e2b3cc461 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Thu, 3 Sep 2026 09:34:32 +0300 Subject: [PATCH 1/5] Document VS Code agent-sandbox filesystem restrictions The sandbox (chat.agent.sandbox.enabled) blocks read/write outside the workspace, causing Step 0 to fail (MODULE_NOT_FOUND on the check script, EROFS on npm cache, unreadable ~/.jfrog) in ways that look like Agent Guard being disabled. Document the env-var credential workaround and VS Code's sandbox-bypass confirmation as the fix. --- .../references/harness-vscode.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md index 2c0b61f..d17f782 100644 --- a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md +++ b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md @@ -77,6 +77,30 @@ Rules for the `inputs` block: - `description`: use the catalog `description`; if empty, construct a brief one. - `Bearer` headers: use `"Bearer ${input:}"` and ask only for the token. +## VS Code's sandbox + +When VS Code's agent-mode terminal sandbox (`chat.agent.sandbox.enabled`) is +on, it blocks filesystem access — read and write — outside the workspace +folder. This surfaces as failures that look like "Agent Guard disabled" but +are a sandbox artifact, not a real answer: + +- Step 0's check script lives outside the workspace and fails to load + (`MODULE_NOT_FOUND`). +- `~/.jfrog/` (jf CLI config) is unreadable, so Step 0 can't resolve a server + and reports exit 1 (Unknown) even though `jf config show` works in a normal + terminal. +- `npx` can't write the npm cache outside the workspace (`EROFS`). + +Unlike Codex, VS Code's sandboxed terminal still forwards the full shell +environment, so `JFROG_URL` + `JFROG_ACCESS_TOKEN` (or legacy `JF_URL` + +`JF_ACCESS_TOKEN`) exported before VS Code starts reach Step 0 and the agent +guard unchanged — prefer that path (see +[agent-guard-common.md](agent-guard-common.md)) over `--server` here, since it +does not depend on reading `~/.jfrog/`. If `MODULE_NOT_FOUND` or `EROFS` +still blocks a command, VS Code offers a sandbox-bypass confirmation ("Run +once outside sandbox" / "Disable sandbox and run") — ask the user to approve +it, or to disable `chat.agent.sandbox.enabled` in Settings, then re-run. + ## Enable Writing the entry is not enough — the server must be started via the UI. If it From 1e8bc21572d5f3106fe1b014af79e9f0d476af23 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Thu, 3 Sep 2026 09:36:53 +0300 Subject: [PATCH 2/5] Trim VS Code sandbox note Condense to the essential facts and workaround. --- .../references/harness-vscode.md | 31 ++++++------------- 1 file changed, 10 insertions(+), 21 deletions(-) diff --git a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md index d17f782..33ab3bb 100644 --- a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md +++ b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md @@ -79,27 +79,16 @@ Rules for the `inputs` block: ## VS Code's sandbox -When VS Code's agent-mode terminal sandbox (`chat.agent.sandbox.enabled`) is -on, it blocks filesystem access — read and write — outside the workspace -folder. This surfaces as failures that look like "Agent Guard disabled" but -are a sandbox artifact, not a real answer: - -- Step 0's check script lives outside the workspace and fails to load - (`MODULE_NOT_FOUND`). -- `~/.jfrog/` (jf CLI config) is unreadable, so Step 0 can't resolve a server - and reports exit 1 (Unknown) even though `jf config show` works in a normal - terminal. -- `npx` can't write the npm cache outside the workspace (`EROFS`). - -Unlike Codex, VS Code's sandboxed terminal still forwards the full shell -environment, so `JFROG_URL` + `JFROG_ACCESS_TOKEN` (or legacy `JF_URL` + -`JF_ACCESS_TOKEN`) exported before VS Code starts reach Step 0 and the agent -guard unchanged — prefer that path (see -[agent-guard-common.md](agent-guard-common.md)) over `--server` here, since it -does not depend on reading `~/.jfrog/`. If `MODULE_NOT_FOUND` or `EROFS` -still blocks a command, VS Code offers a sandbox-bypass confirmation ("Run -once outside sandbox" / "Disable sandbox and run") — ask the user to approve -it, or to disable `chat.agent.sandbox.enabled` in Settings, then re-run. +`chat.agent.sandbox.enabled` blocks filesystem access outside the workspace, +which can look like "Agent Guard disabled" but isn't: `MODULE_NOT_FOUND` on +Step 0's script, unreadable `~/.jfrog/` (server resolves to Unknown), `EROFS` +on the npm cache. + +Unlike Codex, env vars still pass through the sandbox — prefer `JFROG_URL` + +`JFROG_ACCESS_TOKEN` (see [agent-guard-common.md](agent-guard-common.md)) over +`--server`. If the failure persists, have the user approve VS Code's +sandbox-bypass prompt ("Run once outside sandbox") or disable +`chat.agent.sandbox.enabled`, then re-run. ## Enable From 98be2f44114045bf229549897767200ff1a1f358 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Thu, 3 Sep 2026 09:39:06 +0300 Subject: [PATCH 3/5] Fix inaccurate sandbox-bypass prompt wording MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "Run once outside sandbox" is Copilot App's wording (a different product), quoted in a still-open VS Code feature request (#333900) asking VS Code to adopt it — not current VS Code UI text. VS Code today shows only its generic tool-confirmation prompt. Verified chat.agent.sandbox.enabled itself directly against VS Code source (src/vs/platform/sandbox/common/settings.ts). --- .../jfrog-mcp-management/references/harness-vscode.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md index 33ab3bb..a04720b 100644 --- a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md +++ b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md @@ -86,9 +86,9 @@ on the npm cache. Unlike Codex, env vars still pass through the sandbox — prefer `JFROG_URL` + `JFROG_ACCESS_TOKEN` (see [agent-guard-common.md](agent-guard-common.md)) over -`--server`. If the failure persists, have the user approve VS Code's -sandbox-bypass prompt ("Run once outside sandbox") or disable -`chat.agent.sandbox.enabled`, then re-run. +`--server`. If the failure persists, have the user approve the tool +confirmation prompt for the command or disable `chat.agent.sandbox.enabled`, +then re-run. ## Enable From e53afecf2e953822caf6fac6330c93bb84fe6dd2 Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Thu, 3 Sep 2026 10:00:33 +0300 Subject: [PATCH 4/5] Address PR review: split MODULE_NOT_FOUND from credential fix - Env vars fix the ~/.jfrog/ credential path only; MODULE_NOT_FOUND (sandbox blocks reading the check script itself) needs the bypass/ disable route instead. Split into two bullets. - Name the actual confirmation mechanism (sandboxBypass: true / "Run in terminal outside the sandbox?"), verified against runInTerminalConfirmationTool.ts in microsoft/vscode. - Note that MCP server env (${input:...}) is resolved by VS Code itself and unaffected by this sandbox. --- .../references/harness-vscode.md | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md index a04720b..b318db8 100644 --- a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md +++ b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md @@ -79,16 +79,20 @@ Rules for the `inputs` block: ## VS Code's sandbox -`chat.agent.sandbox.enabled` blocks filesystem access outside the workspace, -which can look like "Agent Guard disabled" but isn't: `MODULE_NOT_FOUND` on -Step 0's script, unreadable `~/.jfrog/` (server resolves to Unknown), `EROFS` -on the npm cache. - -Unlike Codex, env vars still pass through the sandbox — prefer `JFROG_URL` + -`JFROG_ACCESS_TOKEN` (see [agent-guard-common.md](agent-guard-common.md)) over -`--server`. If the failure persists, have the user approve the tool -confirmation prompt for the command or disable `chat.agent.sandbox.enabled`, -then re-run. +`chat.agent.sandbox.enabled` blocks filesystem access outside the workspace +for the agent's terminal commands — not for MCP server `env`, where +`${input:...}` values are resolved by VS Code itself and are unaffected. Two +distinct failures, which can both look like "Agent Guard disabled" but aren't: + +- `MODULE_NOT_FOUND` on Step 0's script — the script file itself is + unreadable; env vars don't help here. Re-run outside the sandbox (the + terminal tool's `sandboxBypass: true`, confirmed via the "Run in terminal + outside the sandbox?" prompt) or disable `chat.agent.sandbox.enabled`. +- Unreadable `~/.jfrog/` (server resolves to Unknown) or `EROFS` on the npm + cache — unlike Codex, env vars still pass through the sandbox, so prefer + `JFROG_URL` + `JFROG_ACCESS_TOKEN` (see + [agent-guard-common.md](agent-guard-common.md)) over `--server`; fall back + to the bypass/disable option above if it still fails. ## Enable From 74671b0755b479dbb4d9c89f250cbd8d4c04a2ed Mon Sep 17 00:00:00 2001 From: Matan Eden <57892946+MatanEden1@users.noreply.github.com> Date: Thu, 3 Sep 2026 10:42:49 +0300 Subject: [PATCH 5/5] Trim VS Code sandbox note wording --- .../references/harness-vscode.md | 23 ++++++++----------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md index b318db8..8374dfe 100644 --- a/plugin/skills/jfrog-mcp-management/references/harness-vscode.md +++ b/plugin/skills/jfrog-mcp-management/references/harness-vscode.md @@ -80,19 +80,16 @@ Rules for the `inputs` block: ## VS Code's sandbox `chat.agent.sandbox.enabled` blocks filesystem access outside the workspace -for the agent's terminal commands — not for MCP server `env`, where -`${input:...}` values are resolved by VS Code itself and are unaffected. Two -distinct failures, which can both look like "Agent Guard disabled" but aren't: - -- `MODULE_NOT_FOUND` on Step 0's script — the script file itself is - unreadable; env vars don't help here. Re-run outside the sandbox (the - terminal tool's `sandboxBypass: true`, confirmed via the "Run in terminal - outside the sandbox?" prompt) or disable `chat.agent.sandbox.enabled`. -- Unreadable `~/.jfrog/` (server resolves to Unknown) or `EROFS` on the npm - cache — unlike Codex, env vars still pass through the sandbox, so prefer - `JFROG_URL` + `JFROG_ACCESS_TOKEN` (see - [agent-guard-common.md](agent-guard-common.md)) over `--server`; fall back - to the bypass/disable option above if it still fails. +for the agent's terminal commands only — MCP server `${input:...}` values are +resolved by VS Code itself and unaffected. + +- `MODULE_NOT_FOUND` on Step 0's script: the script itself is unreadable, env + vars won't help. Re-run with `sandboxBypass: true` ("Run in terminal + outside the sandbox?") or disable `chat.agent.sandbox.enabled`. +- Unreadable `~/.jfrog/` (Unknown) or `EROFS` on the npm cache: unlike Codex, + env vars pass through the sandbox — prefer `JFROG_URL` + + `JFROG_ACCESS_TOKEN` ([agent-guard-common.md](agent-guard-common.md)) over + `--server`; same bypass fallback otherwise. ## Enable