[Feat] Integrate DCG with command auto-approval and denial UX

[navedmerchant]

Related GitHub Issue

Closes #1058
Completes #1049. Split from #1050.

Description

Completes the feature at the command approval boundary. DCG-approved commands can bypass the legacy allowlist only when command auto-approval and DCG are enabled. DCG-blocked commands are protected and require explicit approval. Disabling DCG preserves existing behavior. Localized reason/rule feedback and a dedicated denied-command chat state are included.

A user can still explicitly approve a DCG-blocked command; denying it does not execute it.

Stack

4 / 4 — base: feat/dcg-setting

The complete stack tip is tree-identical to the original #1050 branch, so no original change was dropped.

Test Procedure

pnpm --dir src exec vitest run core/auto-approval/__tests__/dcg.spec.ts core/tools/__tests__/executeCommandTool.spec.ts
pnpm --dir packages/types exec vitest run src/__tests__/message.test.ts
pnpm --dir webview-ui exec vitest run src/components/chat/__tests__/ChatRow.command-denied.spec.tsx src/components/chat/__tests__/CommandExecution.spec.tsx
pnpm --dir packages/types check-types
pnpm --dir src check-types
pnpm --dir webview-ui check-types
pnpm --dir src bundle
pnpm --dir webview-ui build

Result: 41 extension, 7 type-package, and 40 webview tests passed; type-checks, production builds, lint, pre-push checks, and i18n validation passed.

Checklist

• Safety boundary covered by tests
• DCG-disabled behavior preserved
• Denied UX and localization included
• Type-check/build/lint passing

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 70c7ab5d-cb77-470f-873a-1ac874af8294

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 86.48649% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/core/tools/ExecuteCommandTool.ts	83.33%	2 Missing and 2 partials ⚠️
src/core/task/Task.ts	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[edelauna]

some minor questions

[edelauna]

All tests here keep autoApprovalEnabled: true. Is there a case worth covering where a user has DCG on but global auto-approval off? The early exit at index.ts:63 handles it, but nothing asserts that DCG never fires when auto-approval is disabled.

[edelauna]

When DCG is enabled, this approves all DCG-allowed commands before getCommandDecision runs — so any entries in deniedCommands are silently bypassed. Worth noting in the comment above, or is that intentional and already communicated elsewhere?