Auto-approve writes to null device files (/dev/null, $null, NUL)

[Copilot]

Writes to null device files were incorrectly requiring approval when chat.tools.terminal.blockDetectedFileWrites is set to outsideWorkspace. These are OS-provided device files that safely discard data and should not trigger workspace boundary checks.

Changes:

• Added _isSafeNullDevicePath() to identify null devices across platforms:
  • /dev/null (Unix/Linux)
  • NUL (Windows CMD, case-insensitive)
  • $null (PowerShell)
• Modified _getResult() to skip workspace validation for null device paths, checked before variable detection to handle $null's $ character
• Updated tests to verify null device writes are auto-approved even without workspace folders

Fixes the scenario shown in the issue where 2>/dev/null triggers an unnecessary approval prompt.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• redirector.gvt1.com
  • Triggering command: /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --crashpad-handler-pid=16574 --enable-crash-reporter=1c02c580-0355-4167-9847-bfd381c0e1a4,no_channel --user-data-dir=/tmp/vscode-tests-1762606799440 --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,16173230850607296853,14407152185923085611,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess --variations-seed-version (dns block)
  • Triggering command: .build/electron/code-oss test/unit/electron/index.js --crash-reporter-directory=/home/REDACTED/work/vscode/vscode/.build/crashes --grep CommandLineFileWriteAnalyzer (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Auto-approve writes to /dev/null</issue_title>
<issue_description>Just saw this come up from Sonnet 4.5, seems like a path we can safely allowlist:

</issue_description>

<agent_instructions>Allow writing to /dev/null, $null (pwsh) and any other relevant safe files. This is in commandLineFileWriteAnalyzer.ts</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Auto-approve writes to /dev/null #276212

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.