Agent Safe Auto-Approve Command List

auto-approve-safe.json

"chat.tools.terminal.autoApprove": {
    "nl": true,

    // ============ PIPE CHAIN SUPPORT ============
    "chat.tools.terminal.allowPipeChains": true,
    "chat.tools.terminal.validatePipeSegments": true,

    // ============ BASIC SYSTEM COMMANDS ============
    "cd": true,
    "echo": true,
    "ls": true,
    "pwd": true,
    "cat": true,
    "head": true,
    "tail": true,
    "grep": true,
    "findstr": true,
    "wc": true,
    "tr": true,
    "cut": true,
    "cmp": true,
    "diff": true,
    "which": true,
    "basename": true,
    "dirname": true,
    "realpath": true,
    "readlink": true,
    "stat": true,
    "file": true,
    "du": true,
    "df": true,
    "sleep": true,
    "column": true,
    "date": true,
    "find": true,
    "sort": true,
    "tree": true,
    "uniq": true,
    "uname": true,
    "hostname": true,
    "whoami": true,
    "printenv": true,
    "awk": true,
    "sed": true,

    // ============ GIT COMMANDS (READ-ONLY + SAFE) ============
    "/^git\\s+(status|diff|log|show)\\b/": true,
    "git status": true,
    "git log": true,
    "git show": true,
    "git diff": true,
    "git grep": true,
    "git branch": true,
    "git blame": true,
    "git reflog": true,
    "/^git\\s+stash\\s+(list|show)\\b/": true,
    "/^git\\s+remote\\s+-v\\b/": true,
    "git checkout": true,
    "/^git\\s+checkout\\s+-b\\b/": true,
    "git rev-parse": true,
    // Commit.ish
    "/^git\\s+add\\b/": true,
    "/^git\\s+commit\\b/": true,
    "/^git\\s+stash\\b(?!.*drop)/": true,
    "/^git\\s+merge\\s+--abort\\b/": true,
    "/^git\\s+rebase\\s+--abort\\b/": true,
    // Block destructive git operations
    "/^git branch\\b.*-(d|D|m|M|-delete|-force)\\b/": false,
    "/^git\\s+push\\s+.*--force/": false,
    "/^git\\s+reset\\s+--hard\\b/": false,
    "/^git\\s+clean\\s+-f/": false,

    "npx": false,

    // ============ NPM COMMANDS ============
    "/^npm\\s+(test|run\\s+lint)\\b/": true,
    "/^npm\\s+(ls|list|view|search|outdated|audit)\\b/": true,
    "/^npm\\s+install\\s+--dry-run\\b/": true,
    "/^npm\\s+ci\\b/": true, // frozen lockfile install
    "/^npm\\s+run\\s+[a-zA-Z0-9:_-]+$/": true,
    "/^npm\\s+install\\b(?!\\s+--dry-run)/": false, // block `npm install [pkg]`
    "/^npm\\s+i\\b/": false, // block `npm i <pkg>`
    "/^npm\\s+(update|uninstall|remove)\\b/": false,

    // ============ PNPM COMMANDS ============
    "/^pnpm\\s+(test|lint)\\b/": true,
    "/^pnpm\\s+(ls|list|outdated|audit)\\b/": true,
    "/^pnpm\\s+install\\s+--frozen-lockfile\\b/": true, // ← frozen lockfile only
    "/^pnpm\\s+--filter\\s+\\w+\\s+(test|typecheck|lint|build)\\b/": true,
    "/^pnpm\\s+exec\\s+eslint\\b/": true,
    "/^pnpm\\s+typecheck\\b/": true,
    "/^pnpm\\s+add\\b/": false, // block `pnpm add <pkg>`
    "/^pnpm\\s+install\\b(?!.*--frozen-lockfile)/": false, // block bare install
    "/^pnpm\\s+dlx\\b/": false,
    "/^pnpm\\s+(remove|update|up)\\b/": false,

    // ============ YARN COMMANDS ============
    "/^yarn\\s+install\\s+--frozen-lockfile\\b/": true, // ← frozen lockfile
    "/^yarn\\s+--frozen-lockfile\\b/": true,
    "/^yarn\\s+(test|lint|build|typecheck|run\\s+[a-zA-Z0-9:_-]+)\\b/": true,
    "/^yarn\\s+(ls|list|outdated|audit|why)\\b/": true,
    "/^yarn\\s+install\\b(?!.*--frozen-lockfile)/": false, // block bare install
    "/^yarn\\s+add\\b/": false, // block `yarn add <pkg>`
    "/^yarn\\s+(remove|upgrade|set\\s+version)\\b/": false,
    "/^yarn\\s+dlx\\b/": false,
    "/^yarn\\s+(remove|up|upgrade)\\b/": false,

    // ============ pip / pip3 ============
    "/^pip3?\\s+install\\s+-r\\s+\\S+/": false, // allow: pip install -r req.txt
    "/^pip3?\\s+(list|show|check|freeze|inspect)\\b/": true,
    "/^pip3?\\s+install\\b(?!\\s+-r)/": false, // block: pip install <pkg>
    "/^pip3?\\b/": false, // pip catch-all
    "/^pip3?\\s+(download|wheel)\\b/": false,

    // ============ python3 -m pip ============
    "/^python3\\s+-m\\s+pip\\s+install\\s+-r\\s+\\S+/": false,
    "/^python3\\s+-m\\s+pip\\s+(list|show|check|freeze)\\b/": true,
    "/^python3\\s+-m\\s+pip\\s+install\\b(?!\\s+-r)/": false,
    "/^python3\\s+-m\\s+pip\\s+(download|wheel)\\b/": false,

    // ============ brew ============
    "/^brew\\s+bundle\\b/": false, // disallow: brew bundle (Brewfile)
    "/^brew\\s+(list|info|deps|leaves|outdated|search)\\b/": true,
    "/^brew\\s+(install|upgrade|reinstall|tap)\\b/": false, // block new installs
    "/^brew\\b/": false, // brew catch-all

    // ============ FORGE/FOUNDRY COMMANDS ============
    // Safe read-only forge commands
    "/^(\\w+=\\w+\\s+)*forge\\s+build\\b.*(?:\\||$)/": true,
    "/^(\\w+=\\w+\\s+)*forge\\s+test\\b.*(?:\\||$)/": true,
    "/^(\\w+=\\w+\\s+)*forge\\s+compile\\b.*(?:\\||$)/": true,
    "/^forge\\s+clean\\b/": true,
    "/^forge\\s+fmt\\b/": true,
    "/^forge\\s+coverage\\b/": true,
    "/^forge\\s+flatten\\b/": true,
    "/^forge\\s+lint\\b/": true,
    "/^forge\\s+selectors\\b/": true,
    "/^forge\\s+snapshot\\b/": true,
    "/^forge\\s+tree\\b/": true,
    "/^forge\\s+inspect\\b/": true,
    "/^forge\\s+config\\b/": true,
    "/^forge\\s+remappings\\b/": true,
    "/^forge\\s+geiger\\b/": true,
    // Forge verification commands (read-only checks)
    "/^forge\\s+verify-bytecode\\b/": true,
    "/^forge\\s+verify-check\\b/": true,
    // Block deployment and contract creation
    "/^forge\\s+create\\b/": false,
    "/^forge\\s+script\\b.*--broadcast/": false,
    "/^forge\\s+verify-contract\\b/": false,

    // ============ CAST COMMANDS ============
    "/^cast\\s+(call|abi-decode|abi-encode|calldata|sig|keccak|index)\\b/": true,
    "/^cast\\s+(block|tx|receipt|logs|storage)\\b/": true,
    "/^cast\\s+(balance|code|nonce|chain-id|gas-price)\\b/": true,
    "/^cast\\s+send\\b/": false,
    "/^cast\\s+publish\\b/": false,

    // ============ DOCKER COMMANDS (READ-ONLY) ==========
    "/^docker\\s+(ps|images|inspect|logs)\\b/": true,
    "/^docker\\s+compose\\s+(ps|logs|config)\\b/": true,

    // ============ MAVEN COMMANDS ============
    "/^mvn\\s+test\\b/": true,
    "/^mvn\\s+clean\\b/": true,
    "/^mvn\\s+verify\\b/": true,

    // ============ MAKE COMMANDS ============
    "/^make\\s+-n\\b/": true,
    "/^make\\s+--dry-run\\b/": true,

    // ============ POWERSHELL COMMANDS ============
    "Get-ChildItem": true,
    "Get-Content": true,
    "Get-Date": true,
    "Get-Random": true,
    "Get-Location": true,
    "Write-Host": true,
    "Write-Output": true,
    "Split-Path": true,
    "Join-Path": true,
    "Start-Sleep": true,
    "Where-Object": true,
    "/^Select-[a-z0-9]/i": true,
    "/^Measure-[a-z0-9]/i": true,
    "/^Compare-[a-z0-9]/i": true,
    "/^Format-[a-z0-9]/i": true,
    "/^Sort-[a-z0-9]/i": true,

    // ============ REGEX PATTERNS FOR PIPES ============
    "/^grep\\s+.*(?:\\||$)/": true,
    "/^head\\s+-?[0-9]+.*(?:\\||$)/": true,
    "/^tail\\s+-?[0-9]+.*(?:\\||$)/": true,
    "/^awk\\s+.*(?:\\||$)/": true,
    "/^sed\\s+.*(?:\\||$)/": true,
    "/^sort\\s+.*(?:\\||$)/": true,
    "/^uniq\\s+.*(?:\\||$)/": true,
    "/^wc\\s+.*(?:\\||$)/": true,
    "/^cut\\s+.*(?:\\||$)/": true,
    "/^tr\\s+.*(?:\\||$)/": true,

    // ============ COMMAND-SPECIFIC SAFETY BLOCKS ============
    "/^column\\b.*-c\\s+[0-9]{4,}/": false,
    "/^date\\b.*(-s|--set)\\b/": false,
    "/^find\\b.*-(delete|exec|execdir|fprint|fprintf|fls|ok|okdir)\\b/": false,
    "/^sort\\b.*-(o|S)\\b/": false,
    "/^tree\\b.*-o\\b/": false,

    // ============ DANGEROUS COMMANDS (EXPLICITLY BLOCKED) ============
    "tee": false,
    "mv": false,
    "rm": false,
    "rmdir": false,
    "del": false,
    "Remove-Item": false,
    "ri": false,
    "rd": false,
    "erase": false,
    "dd": false,
    "kill": false,
    "ps": false,
    "top": false,
    "Stop-Process": false,
    "spps": false,
    "taskkill": false,
    "taskkill.exe": false,
    "curl": false,
    "wget": false,
    "Invoke-RestMethod": false,
    "Invoke-WebRequest": false,
    "irm": false,
    "iwr": false,
    "chmod": false,
    "chown": false,
    "Set-ItemProperty": false,
    "sp": false,
    "Set-Acl": false,
    "jq": false,
    "xargs": false,
    "eval": false,
    "Invoke-Expression": false,
    "iex": false,
    "sudo": false,

    // Block pipe chains with dangerous commands
    "/^.*\\|\\s*sh\\b/": false,
    "/^.*\\|\\s*bash\\b/": false,
    "/^.*\\|\\s*zsh\\b/": false,
    "/^.*\\|\\s*powershell\\b/": false,
    "/^.*>\\s*\\/dev\\//": false,
    "/^.*&&.*rm\\b/": false,
    "/^.*;.*rm\\b/": false,
    "/^.*&&.*curl\\b/": false,
    "/^.*;.*wget\\b/": false,
    "/sudo/": false,

    // Third-parties
    "act": true,
    "slither": true,
    "aderyn": true,
  }