Require confirmation for sed in-place terminal commands, agent host - #328882
Merged
Conversation
Add a shared semantic sed analyzer and apply it before Agent Host terminal allow rules so in-place and runtime-resolved option forms cannot auto-approve. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a shared sed analyzer to prevent auto-approval of potentially destructive in-place edits.
Changes:
- Detects in-place and runtime-expanded
sedoptions. - Applies a non-overridable approval gate.
- Adds analyzer, approver, and permission tests.
Show a summary per file
| File | Description |
|---|---|
sedCommandAnalyzer.ts |
Implements shell-word and sed option analysis. |
sedCommandAnalyzer.test.ts |
Tests safe and confirmation-required forms. |
commandAutoApprover.ts |
Applies the safety gate before allow rules. |
commandAutoApprover.test.ts |
Tests gate behavior and rule precedence. |
sessionPermissions.test.ts |
Tests session-level confirmation behavior. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Balanced
Use one GNU/BSD-aware analyzer in workbench and Agent Host, applying existing destination policies to static writes and failing closed otherwise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
anthonykim1
changed the title
Normalize sed executable matching for PowerShell and avoid treating option characters after an invalid short option as in-place flags. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
Use explicit analyzer callbacks for TypeScript and quote native Windows paths in Bash session-policy tests so shell decoding preserves the absolute path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
Move the existing workbench sed parser to terminal common and reuse its in-place detection as a non-overridable Agent Host confirmation gate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
anthonykim1
changed the title
Place the shared parser and its tests under terminal/common/autoApprove to make the feature-specific ownership explicit without changing behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bda42f98-e73f-417f-b7e6-03cff9e2f604
anthonykim1
marked this pull request as ready for review
August 4, 2026 06:39
anthonykim1
changed the title
anthonykim1
enabled auto-merge (squash)
August 4, 2026 06:42
DonJayamanne
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves: #328901
Follow-up: #328898
SedFileWriteParsertovs/platform/terminal/common/autoApproveso workbench and Agent Host share the same canonical in-place detection.-i,-I, clustered and backup-suffix variants, BSD empty suffixes, and--in-place.sedauto-approval and the existing-e/-fdeny rules.Inspirations from:
SedFileWriteParser, moved to the shared terminal auto-approval layer with its comments and behavior preserved.CommandAutoApprover._matchSubCommands, before configured allow rules are evaluated.handles sed with blocked argscoverage.