Add safe readonly commands to terminal auto approve defaults

[Copilot]

This PR adds a comprehensive set of safe and common readonly commands to the terminal auto approve defaults, improving the user experience by automatically approving commonly used commands that don't modify system state.

Changes Made

Added Safe Commands (Auto-approved by default)

Unix/Linux commands (16):

• echo, ls, pwd, cat, head, tail, grep, find, which, whoami, date, hostname, ps, wc, sort, uniq

PowerShell commands (7):

• Get-ChildItem, Get-Content, Get-Location, Get-Date, Get-Host, Get-Process, Get-Service

PowerShell commands use case-insensitive regex patterns (e.g., /^Get-ChildItem\\b/i) to match variations like get-childitem or GET-CHILDITEM.

Preserved Security

All existing dangerous commands remain denied by default:

• rm, rmdir, del, kill, curl, wget, eval, chmod, chown, Remove-Item

Testing

Added comprehensive test suite covering:

• All new safe commands with various arguments
• Case-insensitive PowerShell command matching
• Dangerous command denial behavior
• Configuration override functionality

Example Usage

With these defaults, users will no longer need explicit approval for common operations like:

# These commands are now auto-approved
echo "Hello world"
ls -la
pwd
cat README.md
grep "TODO" *.js
Get-ChildItem C:\
Get-Content file.txt

While still requiring approval for potentially dangerous operations:

# These still require explicit approval
rm important-file.txt
del *.exe
kill 1234
Remove-Item folder -Recurse

Users can still override any default by explicitly setting commands to true or false in their chat.tools.terminal.autoApprove configuration.

Fixes #259668.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• electronjs.org
  • Triggering command: node-gyp (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.