Block auto-approve for sed scripts that run commands or write files

[anthonykim1]

Part of: #329218

• Extend the default sed deny rules to cover standalone e, r, R, w, and W commands supplied as positional scripts.
• Match commands at the start of a script, after ;, or inside { ... }, including line, $, /regex/, and repeated // addresses.
• Keep quoted-script matching delimiter-aware and escape-aware, and allow the whitespace, ! negation, and end-of-command boundaries accepted by sed.
• Skip leading flags and operands consumed by -l/--line-length so the positional script is still inspected.
• Apply the same policy to the workbench defaults and the Agent Host fallback defaults.
• Preserve auto-approval for ordinary forms such as sed 's/foo/bar/g' file.txt, sed -n '1,10p' file.txt, and sed '/w/d' file.txt.

The patterns intentionally fail safe: a literal ;e or {e inside a replacement string asks for confirmation instead of auto-approving. A shared script analyzer can remove that conservative match and cover additional sed grammar without duplicating more regex logic; that follow-up is tracked in #329218.

---

Inspirations from:

• The "safe command with dangerous arg blocking" rule shape follows the existing find and rg entries.
• The patterns being replaced are the existing sed deny rules in terminalChatAgentToolsConfiguration.ts and their Agent Host copy in commandAutoApprover.ts.
• Keeping both default tables aligned follows the existing shared-rule precedent of gitAutoApproveRules.
• The structural parsing follow-up is inspired by SedFileWriteParser, which is already shared by both surfaces and applied in _matchSubCommands.

[Copilot]

Pull request overview

Tightens default sed auto-approval rules across workbench and Agent Host.

Changes:

• Adds deny patterns for dangerous positional sed scripts.
• Mirrors rules across both approval implementations.
• Adds regression tests for blocked forms.

Show a summary per file

File	Description
commandLineAutoApprover.test.ts	Tests workbench defaults.
terminalChatAgentToolsConfiguration.ts	Extends workbench deny rules.
commandAutoApprover.test.ts	Tests Agent Host defaults.
commandAutoApprover.ts	Mirrors Agent Host deny rules.

Review details

Suppressed comments (2)

src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts:321

• The unquoted rule omits the /regex/ address grammar supported by the quoted rules. sed /pat/e input.txt is a valid shell invocation, and GNU sed's argumentless e executes matching pattern-space contents; this line does not match it, so the generic sed allow rule approves it. Include regex addresses in the unquoted grammar and add a regression case.

			// Unquoted positional script form (e.g. `sed 1e id`, `sed w file`)
			'/^sed\\b(?:\\s+-\\S+)*\\s+(?:(?:\\d+|\\$)(?:,(?:\\d+|\\$))?)?[erRwW]\\s/': false,

src/vs/platform/agentHost/node/commandAutoApprover.ts:651

• The mirrored unquoted rule omits /regex/ addresses. sed /pat/e input.txt is valid, and GNU sed's argumentless e executes matching pattern-space contents; because this does not match any deny rule, it is approved by sed: true. Include the regex-address grammar here and cover it in the Agent Host test.

	// Unquoted positional script form (e.g. `sed 1e id`, `sed w file`)
	'/^sed\\b(?:\\s+-\\S+)*\\s+(?:(?:\\d+|\\$)(?:,(?:\\d+|\\$))?)?[erRwW]\\s/': false,

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (4)

src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts:323

• This quote/address scan still has valid bypasses. sed "s/a/\\\"/;e id" file stops scanning at the escaped ", and sed '/x/p;//e id' file uses sed's valid empty // address, which this +-based address branch rejects; both then fall through to sed: true. Consume escaped characters before checking the closing delimiter, permit the empty-regex address where a prior expression can establish it, and add both regressions.

			'/^sed\\b(?:\\s+-\\S+)*\\s+([\'"])(?:(?!\\1).)*[;{]\\s*(?:(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/)(?:\\s*,\\s*(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/))?)?\\s*!?\\s*[erRwW](?:\\s|\\1|[;}])/': false,

src/vs/platform/agentHost/node/commandAutoApprover.ts:651

• This quote/address scan still has valid bypasses. sed "s/a/\\\"/;e id" file stops scanning at the escaped ", and sed '/x/p;//e id' file uses sed's valid empty // address, which this +-based address branch rejects; both then fall through to sed: true. Consume escaped characters before checking the closing delimiter, permit the empty-regex address where a prior expression can establish it, and add both regressions.

	'/^sed\\b(?:\\s+-\\S+)*\\s+([\'"])(?:(?!\\1).)*[;{]\\s*(?:(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/)(?:\\s*,\\s*(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/))?)?\\s*!?\\s*[erRwW](?:\\s|\\1|[;}])/': false,

src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts:325

• This still auto-approves the valid GNU sed script sed e (and therefore a pipeline such as printf 'id\n' | sed e). With no command argument, e executes the current pattern space, but the unquoted matcher requires trailing whitespace, so the subcommand falls through to sed: true. Treat end-of-command as a valid boundary and add a regression for the no-argument e form.

			'/^sed\\b(?:\\s+-\\S+)*\\s+(?:(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/)(?:\\s*,\\s*(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/))?)?\\s*!?\\s*[erRwW]\\s/': false,

src/vs/platform/agentHost/node/commandAutoApprover.ts:653

• This still auto-approves the valid GNU sed script sed e (and therefore a pipeline such as printf 'id\n' | sed e). With no command argument, e executes the current pattern space, but the unquoted matcher requires trailing whitespace, so the subcommand falls through to sed: true. Treat end-of-command as a valid boundary and add a regression for the no-argument e form.

	'/^sed\\b(?:\\s+-\\S+)*\\s+(?:(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/)(?:\\s*,\\s*(?:\\d+|\\$|\\/(?:\\\\.|[^\\/])+\\/))?)?\\s*!?\\s*[erRwW]\\s/': false,

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Balanced