Microsoft/vscode
1
0
Fork 0
mirror of https://github.com/microsoft/vscode.git synced 2026-02-15 07:28:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add readonly and lock file commands for npm, yarn and pnpm

Browse Source 
Fixes #286463
This commit is contained in:
Daniel Imms
2026-01-08 12:22:28 -08:00
parent c0848ca7d1
commit b069e3461d
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts
View File

@@ -242,6 +242,37 @@ export const terminalChatAgentToolsConfiguration: IStringDictionary<IConfigurati
// #endregion
// #region Package managers (npm, yarn, pnpm)
//
// Read-only commands that don't modify files or execute arbitrary code.
// npm read-only commands
'/^npm\\s+(ls|list|outdated|view|info|show|explain|why|root|prefix|bin|search|doctor|fund|repo|bugs|docs|home|help(-search)?)\\b/': true,
'/^npm\\s+config\\s+(list|get)\\b/': true,
'/^npm\\s+pkg\\s+get\\b/': true,
'/^npm\\s+audit$/': true,
'/^npm\\s+cache\\s+verify\\b/': true,
// yarn read-only commands
'/^yarn\\s+(list|outdated|info|why|bin|help|versions)\\b/': true,
'/^yarn\\s+licenses\\b/': true,
'/^yarn\\s+audit\\b(?!.*\\bfix\\b)/': true,
'/^yarn\\s+config\\s+(list|get)\\b/': true,
'/^yarn\\s+cache\\s+dir\\b/': true,
// pnpm read-only commands
'/^pnpm\\s+(ls|list|outdated|why|root|bin|doctor)\\b/': true,
'/^pnpm\\s+licenses\\b/': true,
'/^pnpm\\s+audit\\b(?!.*\\bfix\\b)/': true,
'/^pnpm\\s+config\\s+list\\b/': true,
// Safe lockfile-only installs since we trust the workspace and lock file is trusted.
'npm ci': true,
'/^yarn\\s+install\\s+--frozen-lockfile\\b/': true,
'/^pnpm\\s+install\\s+--frozen-lockfile\\b/': true,
// #endregion
// #region Safe + disabled args
//
// Commands that are generally allowed with special cases we block. Note that shell
@@ -351,6 +382,7 @@ export const terminalChatAgentToolsConfiguration: IStringDictionary<IConfigurati
eval: false,
'Invoke-Expression': false,
iex: false,
// #endregion
} satisfies Record<string, boolean | { approve: boolean; matchCommandLine?: boolean }>,
},