Allow trusted host init scripts to preserve direct-script review

Inizia tracciando il flusso di approvazione e revisione degli script diretti dello strumento shell integrato insieme all’API pubblica shell.initScripts per sessione. Confronta il modo in cui sono rappresentati gli script di attivazione dell’host Bash e PowerShell, quindi determina come il contenuto esatto o i metadati di attendibilità potrebbero essere associati all’azione sottoposta a revisione senza indebolire la revisione degli script controllati dall’utente o illeggibili; il lavoro è completato quando viene preservata la revisione sicura degli script diretti per gli script host esplicitamente attendibili e aggiornabili.

Context

VS Code is adopting the public per-session shell.initScripts API so the SDK built-in shell tool can load the user's shell profile and activate the workspace-selected Python environment:

https://github.com/microsoft/vscode/pull/332593

Observed behavior

With no init scripts configured, a direct script invocation can be reviewed using the script and interpreter content under the normal permission flow.

When the same session has any host-provided shell.initScripts entry, the direct script invocation instead requires explicit approval because the shell environment can alter the script action.

This is secure as a conservative default, but it means an SDK consumer cannot opt into a known, host-generated activation script without changing approval behavior for otherwise identical direct script commands.

Ask

Please consider a public SDK contract for trusted host-provided init scripts that preserves safe direct-script review when possible.

Possible shapes include:

• allowing the SDK/runtime to incorporate the exact init-script content into the reviewed action/fingerprint; or
• adding explicit trust metadata for host-generated init scripts, with a conservative default for existing callers.

The behavior must remain secure when init scripts are user-controlled, mutable, unreadable, or otherwise cannot be bound to the reviewed action.

Consumer requirements

• Per-session and updateable, matching shell.initScripts.
• Applies to the built-in shell tool.
• Does not weaken approval for arbitrary or unbound startup scripts.
• Works for Bash and PowerShell host activation scripts.