Change:
It's an edge case but worthwhile considering 1) Ensure that all new windows are in restricted mode by default 2) Open a new empty window (no open files at all, no open folder) 3) Use <kbdCmd</kbd+<kbd`</kbd-prompt for trusting the workspace, but there is nothing there to be trusted
In this case, it definitely gets in the way that we ask about trust, and also doesn't make too much to limit access to the terminal. However, what considerations should be in place for when someone decides to bring in untrusted content into the workspace after the terminal is opened? Does this matter for empty workspaces
it's only useful for the terminal if the folder is of a potentially foreign origin. I could special case this since it's going to open in the home directory anyway, but should it even be possible to have an empty window in restricted mode? Might need to handle this special case in multiple places if it's not handled by the trust request service?
we have settings to configure the empty window experience... this allows empty windows to bring in untrusted content easily without prompting.
Ok, let's allow opening the terminal if the active workspace root is undefined then as it's safe in that case.

Discussion:
import { IModelService } from 'vs/editor/common/services/model'; import { ITextModelContentProvider, ITextModelService } from 'vs/editor/common/services/resolverService'; import { IDialogService, IConfirmationResult } from 'vs/platform/dialogs/common/dialogs'; <ins> import { IHistoryService } from 'vs/workbench/services/history/common/history'; import { Schemas } from 'vs/base/common/network'; </ins> const enum Constants { /**

@IWorkbenchEnvironmentService workbenchEnvironmentService: IWorkbenchEnvironmentService, @IWorkspaceContextService private readonly _workspaceContextService: IWorkspaceContextService, @IEditorService private readonly _editorService: IEditorService, <del> @IWorkspaceTrustRequestService private readonly _workspaceTrustRequestService: IWorkspaceTrustRequestService </del> <ins> @IWorkspaceTrustRequestService private readonly _workspaceTrustRequestService: IWorkspaceTrustRequestService, @IHistoryService private readonly _historyService: IHistoryService </ins> ) { super();

if (this._isDisposed) { return; } <del> const trusted = await this._trust(); if (!trusted) { this._onProcessExit({ message: nls.localize('workspaceNotTrustedCreateTerminal', "Cannot launch a terminal process in an untrusted workspace") }); </del> <ins> const activeWorkspaceRootUri = this._historyService.getLastActiveWorkspaceRoot(Schemas.file); if (activeWorkspaceRootUri) { const trusted = await this._trust(); if (!trusted) { this._onProcessExit({ message: nls.localize('workspaceNotTrustedCreateTerminal', "Cannot launch a terminal process in an untrusted workspace") }); } } else if (this._cwd && this._userHome && this._cwd !== this._userHome) { // something strange is going on if cwd is not userHome in an empty workspace this._onProcessExit({ message: nls.localize('workspaceNotTrustedCreateTerminalCwd', "Cannot launch a terminal process in an untrusted workspace with cwd {0} and userHome {1}", this._cwd, this._userHome) }); </ins> } // Re-evaluate dimensions if the container has been set since the xterm instance was created