Add Agent Host PowerShell nested script-block auto-approval regressions (#329290)

Add PowerShell nested script-block auto-approval regressions

Cover Measure-Command and related wrapper shapes so nested denied commands
inside PowerShell script blocks cannot be auto-approved when the PowerShell
grammar is selected.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 102bf1fe-34f3-4b81-b22f-5677ace2be4d

Author: anthonykim1

src/vs/platform/agentHost/test/node/commandAutoApprover.test.ts

@@ -502,6 +502,32 @@ suite('CommandAutoApprover', () => {
 			], ['denied', 'denied']);
 		});
 
+		// Reported PowerShell wrapper shapes: an outer allowed cmdlet must not
+		// hide nested denied/non-allowed commands inside a script block. The Bash
+		// grammar keeps `{ ... }` opaque, so the same rules can incorrectly
+		// approve the line when the wrong dialect is selected.
+		test('does not auto-approve denied commands nested in Measure-Command script blocks', () => {
+			const rules = {
+				...pwsh,
+				autoApproveRules: {
+					'Measure-Command': true,
+					'Where-Object': true,
+					'Set-Content': false,
+					'Start-Process': false,
+					'Invoke-Expression': false,
+				},
+			};
+			assert.deepStrictEqual([
+				approver.shouldAutoApprove('Measure-Command { Set-Content -Path out.txt -Value pwned }', rules),
+				approver.shouldAutoApprove('Measure-Command { Invoke-Expression "Write-Output hi" }', rules),
+				approver.shouldAutoApprove('Get-ChildItem | Where-Object { Start-Process notepad }', rules),
+				// Visible separators already rejected nested denied commands.
+				approver.shouldAutoApprove('Write-Host hi; Set-Content -Path out.txt -Value pwned', rules),
+				// The wrong dialect demonstrates the opaque-block bypass.
+				approver.shouldAutoApprove('Measure-Command { Set-Content -Path out.txt -Value pwned }', { language: 'bash', autoApproveRules: rules.autoApproveRules }),
+			], ['denied', 'denied', 'denied', 'denied', 'approved']);
+		});
+
 		// An unquoted `$null` discards PowerShell output; both the spaced form (a
 		// `redirection` node) and the no-space form (a `generic_token`) must be
 		// recognized. POSIX sinks and real file targets still require confirmation.

src/vs/platform/agentHost/test/node/sessionPermissions.test.ts

@@ -313,6 +313,23 @@ suite('SessionPermissionManager', () => {
 		], [ToolCallConfirmationReason.NotNeeded, undefined, false, true]);
 	});
 
+	test('PowerShell script-block payloads with nested denials require confirmation', async () => {
+		configService.updateRootConfig({
+			[AgentHostTerminalAutoApproveRulesConfigKey]: {
+				'Measure-Command': true,
+				'Set-Content': false,
+				'Invoke-Expression': false,
+			},
+		});
+		assert.deepStrictEqual([
+			await permissions.getAutoApproval(powershellEvent('Measure-Command { Set-Content -Path out.txt -Value pwned }'), sessionUri),
+			await permissions.getAutoApproval(powershellEvent('Measure-Command { Invoke-Expression "Write-Output hi" }'), sessionUri),
+			await permissions.getAutoApproval(shellEvent('Write-Host hi; Set-Content -Path out.txt -Value pwned', 'powershell'), sessionUri),
+			// Missing dialect remains fail-closed even for an otherwise allowlisted outer command.
+			await permissions.getAutoApproval(shellEvent('Measure-Command { Get-ChildItem }', undefined), sessionUri),
+		], [undefined, undefined, undefined, undefined]);
+	});
+
 	test('PowerShell redirects require a literal approved destination', async () => {
 		const dynamicResults = [];
 		for (const dest of ['$HOME/outside.txt', '$env:TEMP/x.txt', '$(Get-Location)/x.txt', '`pwd`/x.txt', '${HOME}/x.txt', '%APPDATA%/x.txt']) {