Allow trusted host init scripts to preserve direct-script review

Comienza siguiendo el flujo de aprobación y revisión de scripts directos de la herramienta de shell integrada junto con la API pública shell.initScripts por sesión. Compara cómo se representan los scripts de activación del host de Bash y PowerShell y, a continuación, determina cómo se podría vincular el contenido exacto o los metadatos de confianza a la acción revisada sin debilitar la revisión de scripts controlados por el usuario o ilegibles; se considera completado cuando se conserva la revisión segura de scripts directos para scripts de host explícitamente confiables y actualizables.

Context

VS Code is adopting the public per-session shell.initScripts API so the SDK built-in shell tool can load the user's shell profile and activate the workspace-selected Python environment:

https://github.com/microsoft/vscode/pull/332593

Observed behavior

With no init scripts configured, a direct script invocation can be reviewed using the script and interpreter content under the normal permission flow.

When the same session has any host-provided shell.initScripts entry, the direct script invocation instead requires explicit approval because the shell environment can alter the script action.

This is secure as a conservative default, but it means an SDK consumer cannot opt into a known, host-generated activation script without changing approval behavior for otherwise identical direct script commands.

Ask

Please consider a public SDK contract for trusted host-provided init scripts that preserves safe direct-script review when possible.

Possible shapes include:

• allowing the SDK/runtime to incorporate the exact init-script content into the reviewed action/fingerprint; or
• adding explicit trust metadata for host-generated init scripts, with a conservative default for existing callers.

The behavior must remain secure when init scripts are user-controlled, mutable, unreadable, or otherwise cannot be bound to the reviewed action.

Consumer requirements

• Per-session and updateable, matching shell.initScripts.
• Applies to the built-in shell tool.
• Does not weaken approval for arbitrary or unbound startup scripts.
• Works for Bash and PowerShell host activation scripts.