remove autoapprove workflow

Author: navedmerchant

packages/types/src/global-settings.ts

@@ -136,7 +136,6 @@ export const globalSettingsSchema = z.object({
 	alwaysAllowModeSwitch: z.boolean().optional(),
 	alwaysAllowSubtasks: z.boolean().optional(),
 	alwaysAllowExecute: z.boolean().optional(),
-	alwaysAllowCommandsExceptDenied: z.boolean().optional(),
 	destructiveCommandGuardEnabled: z.boolean().optional(),
 	alwaysAllowFollowupQuestions: z.boolean().optional(),
 	followupAutoApproveTimeoutMs: z.number().optional(),

packages/types/src/vscode-extension-host.ts

@@ -274,7 +274,6 @@ export type ExtensionState = Pick<
 	| "alwaysAllowSubtasks"
 	| "alwaysAllowFollowupQuestions"
 	| "alwaysAllowExecute"
-	| "alwaysAllowCommandsExceptDenied"
 	| "destructiveCommandGuardEnabled"
 	| "followupAutoApproveTimeoutMs"
 	| "allowedCommands"

src/core/auto-approval/__tests__/commands.spec.ts

@@ -36,28 +36,6 @@ describe("getCommandDecision", () => {
 		const result = getCommandDecision(command, ["*"])
 		expect(result).toBe("auto_approve")
 	})
-
-	describe("allow all except denied mode", () => {
-		it("auto-approves a command that is not in the allowlist or denylist", () => {
-			expect(getCommandDecision("unknown command", [], ["rm"], true)).toBe("auto_approve")
-		})
-
-		it("auto-denies a command matching the denylist even if a longer allowlist entry matches", () => {
-			expect(getCommandDecision("rm --dry-run file", ["rm --dry-run"], ["rm"], true)).toBe("auto_deny")
-		})
-
-		it("auto-denies a command chain when any sub-command matches the denylist", () => {
-			expect(getCommandDecision("git status && rm file", [], ["rm"], true)).toBe("auto_deny")
-		})
-
-		it("preserves dangerous substitution protection", () => {
-			expect(getCommandDecision('echo "${var@P}"', [], [], true)).toBe("ask_user")
-		})
-
-		it("preserves malformed command protection", () => {
-			expect(getCommandDecision("sh -c 'echo a", [], [], true)).toBe("malformed_command")
-		})
-	})
 })
 
 describe("containsDangerousSubstitution — node -e one-liner false positive regression", () => {

src/core/auto-approval/__tests__/dcg.spec.ts

@@ -15,14 +15,13 @@ describe("Destructive Command Guard auto-approval precedence", () => {
 		alwaysAllowFollowupQuestions: false,
 		allowedCommands: ["echo"],
 		deniedCommands: ["rm"],
-		alwaysAllowCommandsExceptDenied: false,
 		destructiveCommandGuardEnabled: true,
 		mcpServers: [],
 	}
 
-	it("ignores Zoo's deny list while DCG is enabled", async () => {
+	it("auto-approves commands allowed by DCG without consulting Zoo's deny list", async () => {
 		expect(await checkAutoApproval({ state: baseState, ask: "command", text: "rm file" })).toEqual({
-			decision: "ask",
+			decision: "approve",
 		})
 	})
 
@@ -32,9 +31,33 @@ describe("Destructive Command Guard auto-approval precedence", () => {
 		).toEqual({ decision: "ask" })
 	})
 
-	it("retains ordinary allowlist auto-approval for DCG-allowed commands", async () => {
-		expect(await checkAutoApproval({ state: baseState, ask: "command", text: "echo safe" })).toEqual({
+	it("auto-approves DCG-allowed commands without consulting Zoo's allowlist", async () => {
+		expect(await checkAutoApproval({ state: baseState, ask: "command", text: "unlisted-command" })).toEqual({
+			decision: "approve",
+		})
+	})
+
+	it("keeps ordinary allowlist auto-approval when DCG is disabled", async () => {
+		const state = { ...baseState, destructiveCommandGuardEnabled: false }
+
+		expect(await checkAutoApproval({ state, ask: "command", text: "echo safe" })).toEqual({
 			decision: "approve",
 		})
 	})
+
+	it("keeps ordinary denylist behavior when DCG is disabled", async () => {
+		const state = { ...baseState, destructiveCommandGuardEnabled: false }
+
+		expect(await checkAutoApproval({ state, ask: "command", text: "rm file" })).toEqual({
+			decision: "deny",
+		})
+	})
+
+	it("keeps ordinary prompts for unlisted commands when DCG is disabled", async () => {
+		const state = { ...baseState, destructiveCommandGuardEnabled: false }
+
+		expect(await checkAutoApproval({ state, ask: "command", text: "unlisted-command" })).toEqual({
+			decision: "ask",
+		})
+	})
 })

src/core/auto-approval/commands.ts

@@ -217,8 +217,7 @@ export type CommandDecision = "auto_approve" | "auto_deny" | "ask_user" | "malfo
  * **Decision Logic:**
  * 1. **Dangerous Substitution Protection**: Commands with dangerous parameter expansions are never auto-approved
  * 2. **Command Parsing**: Split command chains (&&, ||, ;, |, &) into individual commands
- * 3. **Individual Validation**: For each sub-command, either apply the longest prefix match rule or, when
- *    `allowAllExceptDenied` is enabled, approve it unless it matches the denylist
+ * 3. **Individual Validation**: For each sub-command, apply longest prefix match rule
  * 4. **Aggregation**: Combine decisions using "any denial blocks all" principle
  *
  * **Return Values:**
@@ -253,14 +252,12 @@ export type CommandDecision = "auto_approve" | "auto_deny" | "ask_user" | "malfo
  * @param command - The full command string to validate
  * @param allowedCommands - List of allowed command prefixes
  * @param deniedCommands - Optional list of denied command prefixes
- * @param allowAllExceptDenied - Auto-approve commands without a denylist match, ignoring the allowlist
  * @returns Decision indicating whether to approve, deny, or ask user
  */
 export function getCommandDecision(
 	command: string,
 	allowedCommands: string[],
 	deniedCommands?: string[],
-	allowAllExceptDenied = false,
 ): CommandDecision {
 	if (!command?.trim()) {
 		return "auto_approve"
@@ -285,10 +282,6 @@ export function getCommandDecision(
 		// Remove simple PowerShell-like redirections (e.g. 2>&1) before checking
 		const cmdWithoutRedirection = cmd.replace(/\d*>&\d*/, "").trim()
 
-		if (allowAllExceptDenied) {
-			return findLongestPrefixMatch(cmdWithoutRedirection, deniedCommands || []) ? "auto_deny" : "auto_approve"
-		}
-
 		return getSingleCommandDecision(cmdWithoutRedirection, allowedCommands, deniedCommands)
 	})
 

src/core/auto-approval/index.ts

@@ -33,7 +33,6 @@ export type AutoApprovalStateOptions =
 	| "mcpServers" // For `alwaysAllowMcp`.
 	| "allowedCommands" // For `alwaysAllowExecute`.
 	| "deniedCommands"
-	| "alwaysAllowCommandsExceptDenied"
 	| "destructiveCommandGuardEnabled"
 
 export type CheckAutoApprovalResult =
@@ -121,15 +120,15 @@ export async function checkAutoApproval({
 			return { decision: "ask" }
 		}
 
-		// DCG only changes commands that its policy blocks. Commands that pass
-		// continue through Zoo's existing allowlist/permission flow.
 		if (state.alwaysAllowExecute === true) {
-			const decision = getCommandDecision(
-				text,
-				state.allowedCommands || [],
-				state.destructiveCommandGuardEnabled === true ? [] : state.deniedCommands || [],
-				state.alwaysAllowCommandsExceptDenied === true,
-			)
+			// Execute commands immediately when DCG allows them. ExecuteCommandTool
+			// marks commands blocked by DCG as protected before reaching this check,
+			// which keeps the explicit user approval prompt for those commands.
+			if (state.destructiveCommandGuardEnabled === true) {
+				return { decision: "approve" }
+			}
+
+			const decision = getCommandDecision(text, state.allowedCommands || [], state.deniedCommands || [])
 
 			if (decision === "auto_approve") {
 				return { decision: "approve" }

src/core/tools/ExecuteCommandTool.ts

@@ -139,9 +139,9 @@ export class ExecuteCommandTool extends BaseTool<"execute_command"> {
 				}
 			}
 
-			// A DCG block is intentionally presented as Zoo's normal command approval
-			// prompt. Passing isProtected bypasses command auto-approval so the user
-			// must explicitly choose whether to execute it.
+			// DCG-approved commands are auto-approved by checkAutoApproval. A DCG
+			// block is presented as Zoo's normal command prompt, with isProtected
+			// forcing the user to explicitly choose whether to execute it.
 			const didApprove = dcgBlocked
 				? await askApproval("command", canonicalCommand, undefined, true)
 				: await askApproval("command", canonicalCommand)

src/core/webview/ClineProvider.ts

@@ -2310,7 +2310,6 @@ export class ClineProvider
 			alwaysAllowWriteOutsideWorkspace,
 			alwaysAllowWriteProtected,
 			alwaysAllowExecute,
-			alwaysAllowCommandsExceptDenied,
 			destructiveCommandGuardEnabled,
 			allowedCommands,
 			deniedCommands,
@@ -2461,7 +2460,6 @@ export class ClineProvider
 			alwaysAllowWriteOutsideWorkspace: alwaysAllowWriteOutsideWorkspace ?? false,
 			alwaysAllowWriteProtected: alwaysAllowWriteProtected ?? false,
 			alwaysAllowExecute: alwaysAllowExecute ?? false,
-			alwaysAllowCommandsExceptDenied: alwaysAllowCommandsExceptDenied ?? false,
 			destructiveCommandGuardEnabled: destructiveCommandGuardEnabled ?? false,
 			alwaysAllowMcp: alwaysAllowMcp ?? false,
 			alwaysAllowModeSwitch: alwaysAllowModeSwitch ?? false,
@@ -2695,7 +2693,6 @@ export class ClineProvider
 			alwaysAllowWriteOutsideWorkspace: stateValues.alwaysAllowWriteOutsideWorkspace ?? false,
 			alwaysAllowWriteProtected: stateValues.alwaysAllowWriteProtected ?? false,
 			alwaysAllowExecute: stateValues.alwaysAllowExecute ?? false,
-			alwaysAllowCommandsExceptDenied: stateValues.alwaysAllowCommandsExceptDenied ?? false,
 			destructiveCommandGuardEnabled: stateValues.destructiveCommandGuardEnabled ?? false,
 			alwaysAllowMcp: stateValues.alwaysAllowMcp ?? false,
 			alwaysAllowModeSwitch: stateValues.alwaysAllowModeSwitch ?? false,

src/core/webview/__tests__/ClineProvider.spec.ts

@@ -1011,22 +1011,21 @@ describe("ClineProvider", () => {
 		expect(state).toHaveProperty("writeDelayMs")
 	})
 
-	test("getStateToPostToWebview returns the saved allow-all-except-denied setting", async () => {
+	test("getStateToPostToWebview returns the saved destructive command guard setting", async () => {
 		await provider.resolveWebviewView(mockWebviewView)
-		await provider.contextProxy.setValue("alwaysAllowCommandsExceptDenied", true)
+		await provider.contextProxy.setValue("destructiveCommandGuardEnabled", true)
 
 		const state = await provider.getStateToPostToWebview()
 
-		expect(state.alwaysAllowCommandsExceptDenied).toBe(true)
+		expect(state.destructiveCommandGuardEnabled).toBe(true)
 	})
 
-	test("getStateToPostToWebview returns the saved destructive command guard setting", async () => {
+	test("getStateToPostToWebview disables destructive command guard by default", async () => {
 		await provider.resolveWebviewView(mockWebviewView)
-		await provider.contextProxy.setValue("destructiveCommandGuardEnabled", true)
 
 		const state = await provider.getStateToPostToWebview()
 
-		expect(state.destructiveCommandGuardEnabled).toBe(true)
+		expect(state.destructiveCommandGuardEnabled).toBe(false)
 	})
 
 	test("language is set to VSCode language", async () => {

webview-ui/src/components/chat/CommandExecution.tsx

@@ -42,7 +42,6 @@ interface CommandExecutionProps {
 export const CommandExecution = ({ executionId, text, icon, title, isDenied = false }: CommandExecutionProps) => {
 	const {
 		terminalShellIntegrationDisabled = false,
-		alwaysAllowCommandsExceptDenied = false,
 		allowedCommands = [],
 		deniedCommands = [],
 		setAllowedCommands,
@@ -247,7 +246,7 @@ export const CommandExecution = ({ executionId, text, icon, title, isDenied = fa
 					<CodeBlock source={command} language="shell" />
 					<OutputContainer isExpanded={isExpanded} output={output} />
 				</div>
-				{command && command.trim() && !alwaysAllowCommandsExceptDenied && !isDenied && (
+				{command && command.trim() && !isDenied && (
 					<CommandPatternSelector
 						patterns={commandPatterns}
 						allowedCommands={allowedCommands}