Respect chat.tools.terminal.autoApprove for agent host

[anthonykim1]

Resolves: #322112
Coming from: #322633
Follow-up in future: #322791

• Add Agent Host root-config plumbing for chat.tools.terminal.autoApprove.
• Forward normalized terminal auto-approve rules from both local and remote Agent Host clients, including updates when chat.tools.terminal.autoApprove or chat.tools.terminal.ignoreDefaultAutoApproveRules changes.
• Respect null, boolean rules, and { approve, matchCommandLine } object rules in Agent Host shell approval.
• Keep chat.tools.terminal.enableAutoApprove=false as the top-level gate for rule-based shell approval.
• Preserve existing Agent Host safety behavior: deny rules win, parser failure prompts, unsafe write redirects still require confirmation, and bundled defaults remain only as a compatibility fallback when no forwarded rules exist.
• Mark the bundled fallback rules for removal once all Agent Host clients are guaranteed to forward the real terminal auto-approve setting before shell approvals run.
• Add coverage for rule normalization, remote forwarding, command auto-approval rule behavior, source-of-truth precedence over fallback defaults, and session permission behavior.
  /cc @justschen

---

Inspirations from:

• Terminal auto-approve setting IDs come from TerminalChatAgentToolsSettingId.
• The chat.tools.terminal.autoApprove value shape, including null and matchCommandLine, comes from the setting schema in terminalChatAgentToolsConfiguration.ts.
• The forwarded rule compilation mirrors the workbench run-in-terminal rule buckets in CommandLineAutoApprover.updateConfiguration.
• The default-rule filtering behavior for chat.tools.terminal.ignoreDefaultAutoApproveRules comes from _mapAutoApproveConfigToRules.

[Copilot]

Pull request overview

Adds agent-host plumbing to forward and enforce VS Code terminal auto-approve rules (chat.tools.terminal.autoApprove) for shell permission decisions, including support for null, boolean, and { approve, matchCommandLine } rule entries, across both local and remote agent-host clients.

Changes:

• Introduces a new agent-host root config key for forwarded terminal auto-approve rules and implements normalization (including “ignore default rules” behavior).
• Updates shell command auto-approval to consume forwarded rules (with bundled defaults as a compatibility fallback when rules aren’t forwarded).
• Adds/extends tests for rule normalization, remote forwarding behavior, and permission decision outcomes.

Show a summary per file

File	Description
src/vs/platform/agentHost/common/agentHostSchema.ts	Adds root-config key + normalization helpers for forwarding effective terminal auto-approve rules.
src/vs/platform/agentHost/browser/remoteAgentHostProtocolClient.ts	Forwards terminal auto-approve rules on connect and on relevant configuration changes (remote client).
src/vs/platform/agentHost/electron-browser/localAgentHostService.ts	Forwards terminal auto-approve rules on connect and on relevant configuration changes (local client).
src/vs/platform/agentHost/node/sessionPermissions.ts	Uses forwarded terminal auto-approve rules during shell permission auto-approval (still gated by enablement setting).
src/vs/platform/agentHost/node/commandAutoApprover.ts	Extends rule compilation/matching to support { approve, matchCommandLine } and forwarded rule sets.
src/vs/platform/agentHost/test/common/agentHostSchema.test.ts	Adds coverage for terminal auto-approve rule normalization and default-ignoring behavior.
src/vs/platform/agentHost/test/electron-browser/remoteAgentHostProtocolClient.test.ts	Adds coverage for forwarding terminal auto-approve rules on connect and when settings change.
src/vs/platform/agentHost/test/node/sessionPermissions.test.ts	Adds coverage ensuring forwarded allow/deny rules affect shell permission outcomes as expected.
src/vs/platform/agentHost/test/node/commandAutoApprover.test.ts	Adds coverage for forwarded rules including null entries and matchCommandLine behavior.

Copilot's findings

• Files reviewed: 9/9 changed files
• Comments generated: 1

[github-actions]

Base: a6d24e1b Current: acbe23d3

No screenshot changes.