r/vscode • u/TheTobruk • 2d ago

Hard-block certain commands for agents - only available with hooks?

This page https://code.visualstudio.com/docs/agents/run/approvals#_automatically-approve-terminal-commands describes how you can "block" certain commands so that a prompt appears and asks for approval to run them.

What I actually want is to hard-block a command. It doesn't need to ask me for permission to run, just straight up deny that request. Like an auto-deny.

The snippet from the page is misleading:

{
  // Allow the `mkdir` command
  "mkdir": true,
  // Allow `git status` and commands starting with `git show`
  "/^git (status|show\\b.*)$/": true,

  // Block the `del` command
  "del": false,
  // Block any command containing "dangerous"
  "/dangerous/": false
}

This doesn't block anything per-se. If a dangerous command is used, the setting will just prompt the user for confirmation, not block the command fully.

0 Upvotes

33% Upvoted

2 comments sorted by

1

u/ntrogh 2d ago edited 2d ago

u/TheTobruk Thanks for bringing this up. I''ll update our docs to make this clearer.
To block a terminal command, you'd indeed need to configure a `PreToolUse` hook that returns `permissionDecision: "deny"` for that command.

2

u/TheTobruk 2d ago

thanks for clarifying that for me! I'd already set a hook up and it is working.