Cache terminal risk assessment by command only

[chrmarti]

#315616

Summary

Fixes the terminal confirmation badge showing Assessing risk… with a spinner every time, instead of using the cached assessment, when re-running the same command outside the sandbox.

The risk assessment cache key was tool.id + stableStringify(parameters). For run_in_terminal the parameter set includes model-generated explanation, goal, and requestUnsandboxedExecutionReason fields, which differ on every invocation even when the underlying command is identical — so the cache never hit on the second run.

This narrows the cache key for run_in_terminal to just `{ command }`. Other tools are unaffected and still key on their full parameter set.

Repro

1. Set `chat.tools.riskAssessment.enabled: true` and `chat.agent.sandbox.enabled: true`
2. In agent mode, run a command that requires unsandboxed access (e.g. `curl https://google.com\`)
3. Trigger the same command again — badge now renders instantly from cache.

Session Context

Key decisions from the development session:

• Cache key scope: Only narrowed for `run_in_terminal` (via the `TerminalToolId.RunInTerminal` id). The previous full-parameter key is preserved for all other tools, since their parameters are typically the deterministic inputs of the call.
• Normalized fields: Only `command` is used. Fields like `explanation`, `goal`, `requestUnsandboxedExecutionReason`, `mode`, `timeout`, and `requestUnsandboxedExecution` are excluded because they're either model-generated descriptive text or execution-mode controls that don't change the risk semantics of the command itself.
• Shared helper: `getCached` and `assess` both go through a single `_cacheKey` helper so the lookup and insertion keys can't drift.

[Copilot]

Pull request overview

This PR fixes risk assessment cache misses for terminal tool invocations by narrowing the cache key used for run_in_terminal from “tool id + full parameter set” to “tool id + normalized parameters (command only)”. This prevents repeated terminal confirmations from showing “Assessing risk…” on every re-run when only model-generated descriptive fields changed.

Changes:

• Introduced a shared _cacheKey(...) helper so getCached(...) and assess(...) use identical cache key logic.
• Added parameter normalization for TerminalToolId.RunInTerminal so only { command } contributes to the cache key.
• Left all other tools’ cache key behavior unchanged (still based on full parameter set via stableStringify).

Show a summary per file

File	Description
src/vs/workbench/contrib/chat/browser/tools/chatToolRiskAssessmentService.ts	Normalizes run_in_terminal cache keys to be command-based and centralizes cache key computation to restore cache hits on repeated runs.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 0