Blanket auto-deny for unapproved commands (hands-free mode)

packages/types/src/__tests__/global-settings.test.ts

@@ -1,4 +1,5 @@
 import {
+	DEFAULT_ALWAYS_DENY_UNAPPROVED_COMMANDS,
 	DEFAULT_DESTRUCTIVE_COMMAND_GUARD_ENABLED,
 	GLOBAL_SETTINGS_KEYS,
 	globalSettingsSchema,
@@ -20,3 +21,20 @@ describe("destructive command guard global setting", () => {
 		expect(() => globalSettingsSchema.parse({ destructiveCommandGuardEnabled: "true" })).toThrow()
 	})
 })
+
+describe("alwaysDenyUnapprovedCommands global setting", () => {
+	it("is opt-in by default", () => {
+		expect(DEFAULT_ALWAYS_DENY_UNAPPROVED_COMMANDS).toBe(false)
+	})
+
+	it("accepts and exposes the persisted setting", () => {
+		expect(globalSettingsSchema.parse({ alwaysDenyUnapprovedCommands: true })).toEqual({
+			alwaysDenyUnapprovedCommands: true,
+		})
+		expect(GLOBAL_SETTINGS_KEYS).toContain("alwaysDenyUnapprovedCommands")
+	})
+
+	it("rejects non-boolean setting values", () => {
+		expect(() => globalSettingsSchema.parse({ alwaysDenyUnapprovedCommands: "true" })).toThrow()
+	})
+})

packages/types/src/global-settings.ts

@@ -49,6 +49,15 @@ export const DEFAULT_DIFF_FUZZY_THRESHOLD = 1.0
 
 export const DEFAULT_DESTRUCTIVE_COMMAND_GUARD_ENABLED = false
 
+/**
+ * Whether commands that are not explicitly auto-approved are automatically
+ * denied (with a structured reason sent to the model) instead of prompting the
+ * user. Opt-in: by default, unapproved commands still ask for confirmation.
+ * Only engages when command auto-approval (`autoApprovalEnabled` +
+ * `alwaysAllowExecute`) is on.
+ */
+export const DEFAULT_ALWAYS_DENY_UNAPPROVED_COMMANDS = false
+
 /**
  * Terminal output preview size options for persisted command output.
  *
@@ -154,6 +163,14 @@ export const globalSettingsSchema = z.object({
 	alwaysAllowSubtasks: z.boolean().optional(),
 	alwaysAllowExecute: z.boolean().optional(),
 	destructiveCommandGuardEnabled: z.boolean().optional(),
+	/**
+	 * Blanket auto-deny for unapproved commands. When true (and command
+	 * auto-approval is engaged), every command that is not explicitly
+	 * auto-approved is automatically denied with a structured reason delivered
+	 * to the model, instead of prompting the user.
+	 * @default false
+	 */
+	alwaysDenyUnapprovedCommands: z.boolean().optional(),
 	alwaysAllowFollowupQuestions: z.boolean().optional(),
 	followupAutoApproveTimeoutMs: z.number().optional(),
 	allowedCommands: z.array(z.string()).optional(),

packages/types/src/vscode-extension-host.ts

@@ -283,6 +283,7 @@ export type ExtensionState = Pick<
 	| "alwaysAllowFollowupQuestions"
 	| "alwaysAllowExecute"
 	| "destructiveCommandGuardEnabled"
+	| "alwaysDenyUnapprovedCommands"
 	| "followupAutoApproveTimeoutMs"
 	| "allowedCommands"
 	| "deniedCommands"