Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Auto-approve tee command and /tmp writes in terminal tool#288328

Draft
Copilot wants to merge 4 commits intomainfrom
copilot/consider-auto-approving-file-writes
Draft

Auto-approve tee command and /tmp writes in terminal tool#288328
Copilot wants to merge 4 commits intomainfrom
copilot/consider-auto-approving-file-writes

Conversation

Copy link
Contributor

Copilot AI commented Jan 16, 2026 •
edited
Loading

Commands like npm run test 2>&1 | tee /tmp/test_output.log were blocked because tee wasn't auto-approved and /tmp writes were rejected.

Changes

Auto-approve tee command

  • Added to default auto-approve list in terminalChatAgentToolsConfiguration.ts
  • Command is safe; file write safety determined by destination path analyzer

Allow /tmp writes on Unix-like systems

  • Modified commandLineFileWriteAnalyzer.ts to permit writes to /tmp/
  • Platform-specific: Unix/Linux/macOS only
  • Existing safety checks remain (variables, command substitutions still blocked)

Test coverage

  • Added tests for /tmp write allowance and subdirectories
  • Added tests for tee with various destinations
  • Updated existing tests expecting /tmp to be blocked

Examples

Now auto-approved:

npm run test:server:main 2>&1 | tee /tmp/test_output.log
echo "data" > /tmp/file.txt

Still require approval:

tee /etc/file.txt          # Protected system directory
tee /home/user/file.txt    # Outside workspace, not /tmp
Original prompt

This section details on the original issue you should resolve

<issue_title>Consider auto approving of file writes to /tmp</issue_title>
<issue_description>Copilot may want to run something like this:

npm run test:server:main 2>&1 | tee /tmp/test_output.log

This will not be auto approved currently because:

  • tee isn't auto approved
  • Even if it was, it's writing to /tmp which we don't allow anywhere atm

We should consider adding auto approve for tee as well as allowing writes to /tmp as part of chat.tools.terminal.blockDetectedFileWrites</issue_description>

Comments on the Issue (you are @copilot in this section)

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@Tyriar Tyriar modified the milestones: February 2026, January 2026 Jan 16, 2026
Copilot AI changed the title [WIP] Consider auto approving file writes to /tmp Auto-approve tee command and /tmp writes in terminal tool Jan 16, 2026
Copilot AI requested a review from Tyriar January 16, 2026 11:59
@Tyriar Tyriar modified the milestones: January 2026, February 2026 Jan 29, 2026
@rzhao271 rzhao271 modified the milestones: February 2026, March 2026 Feb 27, 2026
sanchirico added a commit to sanchirico/vscode that referenced this pull request Mar 1, 2026
@sanchirico
Auto-approve tee and allow /tmp writes
0ca3e00 
Adds `tee` to the auto-approve allowlist, a `TeeFileWriteParser` so the file
write analyzer detects `tee`'s file arguments (same pattern as `SedFileWriteParser`),
and allows writes to `/tmp` and `/private/tmp` in the analyzer.

On macOS `/tmp` is a symlink to `/private/tmp`. If the shell resolves
the symlink before the path reaches the analyzer, `startsWith('/tmp/')` misses
it. Checking both prefixes covers both cases.

I left out `/var/tmp`. I believe it's more for stuff that survives reboots and
microsoft#288327 only asks for `/tmp`.

Not sure if `/private/tmp` is in scope for microsoft#288327. Let me know if you'd rather drop it and keep only `/tmp`.

microsoft#288328 covers most of the same ground but doesn't handle `/private/tmp`.
Copilot also didn't touch the no workspace folders path to allow `/tmp` there,
so I left that out too. If the AI that filed the PR didn't think it was needed,
who am I to argue. It probably knows more than me. Let me know if you want it
added though.

For the pre-existing tests that used `/tmp/file.txt` as the "outside workspace - block" example, I updated the path to `/etc/file.txt` to preserve the original intent rather than flipping them to "allow" like microsoft#288328 does (which just makes them redundant with the new allow tests).

Tests added for `/tmp`, `/private/tmp`, and `tee` with various destinations.

Fixes microsoft#288327
sanchirico added a commit to sanchirico/vscode that referenced this pull request Mar 1, 2026
@sanchirico
Auto-approve tee and allow /tmp writes
a6967f5 
Feel free to reject if this is more than what's wanted for microsoft#288327, happy to take a different approach.

I thought this would be a simple first PR, but adding `tee` means the file write analyzer needs to know which files `tee` targets (redirections are already caught by tree-sitter). So it also needed a `TeeFileWriteParser` and a shared tokenizer extraction.

Adds `tee` to the auto-approve allowlist, a `TeeFileWriteParser` so the file
write analyzer detects `tee`'s file arguments (same pattern as `SedFileWriteParser`),
and allows writes to `/tmp` and `/private/tmp` in the analyzer.

On macOS `/tmp` is a symlink to `/private/tmp`. If the shell resolves
the symlink before the path reaches the analyzer, `startsWith('/tmp/')` misses
it. Checking both prefixes covers both cases.

I left out `/var/tmp`. I believe it's more for stuff that survives reboots and
microsoft#288327 only asks for `/tmp`.

Not sure if `/private/tmp` is in scope for microsoft#288327. Let me know if you'd rather drop it and keep only `/tmp`.

microsoft#288328 covers most of the same ground but doesn't handle `/private/tmp`.
Copilot also didn't touch the no-workspace-folders path to allow `/tmp` there,
so I added that too.

Also extracts the duplicate `_tokenizeCommand` from `SedFileWriteParser` into a shared `commandParserUtils.ts`.

For pre-existing tests that used `/tmp/file.txt` as the "outside workspace - block" example, I updated the path to `/etc/file.txt` to preserve the original intent rather than flipping them to "allow" like microsoft#288328 does (which just makes them redundant with the new allow tests).

Tests added for `/tmp`, `/private/tmp`, and `tee` with various destinations.

Fixes microsoft#288327
sanchirico added a commit to sanchirico/vscode that referenced this pull request Mar 1, 2026
@sanchirico
Auto-approve tee and allow /tmp writes
108afb1 
I'm not 100% sure about this. I thought this would be a simple first PR, but adding `tee` means the file write analyzer needs to know which files `tee` targets. So it also needed a `TeeFileWriteParser` and shared tokenizer extraction?

This adds `tee` to the auto-approve allowlist, a `TeeFileWriteParser` so the file
write analyzer detects `tee`'s file arguments (same pattern as `SedFileWriteParser`),
and allows writes to `/tmp` and `/private/tmp` in the analyzer.

On macOS `/tmp` is a symlink to `/private/tmp`. If the shell resolves
the symlink before the path reaches the analyzer, `startsWith('/tmp/')` misses
it. Checking both prefixes covers both cases.

I left out `/var/tmp`. I believe it's more for stuff that survives reboots and
microsoft#288327 only asks for `/tmp`.

Not sure if `/private/tmp` is in scope for microsoft#288327. Let me know if you'd rather drop it and keep only `/tmp`.

microsoft#288328 covers most of the same ground but doesn't handle `/private/tmp`.
Copilot also didn't touch the no-workspace-folders path to allow `/tmp` there,
so I added that too.

Also extracts the duplicate `_tokenizeCommand` from `SedFileWriteParser` into a shared `commandParserUtils.ts`.

For pre-existing tests that used `/tmp/file.txt` as the "outside workspace - block" example, I updated the path to `/etc/file.txt` to preserve the original intent rather than flipping them to "allow" like microsoft#288328 does (which just makes them redundant with the new allow tests).

Tests added for `/tmp`, `/private/tmp`, and `tee` with various destinations.

Fixes microsoft#288327
@sanchirico sanchirico mentioned this pull request Mar 1, 2026
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Tyriar Tyriar Awaiting requested review from Tyriar

At least 1 approving review is required to merge this pull request.

Assignees

@Tyriar Tyriar

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

1.111.0

Development

Successfully merging this pull request may close these issues.

Consider auto approving of file writes to /tmp

3 participants

@Tyriar @rzhao271