fix: enforce denied commands regardless of auto-approval settings

[roomote-v0]

Related GitHub Issue

Closes: #12292

Description

This PR attempts to address Issue #12292. Feedback and guidance are welcome.

Problem: The denied commands list was only checked inside the alwaysAllowExecute === true guard in checkAutoApproval(). This meant:

1. When alwaysAllowExecute was false, the deny list was completely ignored
2. Agents could bypass the deny list by wrapping denied commands inside chains (&&, ||, ;) or multi-line scripts (heredocs)

Fix: Moved the denied commands check to run before the autoApprovalEnabled guard in checkAutoApproval(). Now denied commands are always blocked regardless of whether auto-approval or alwaysAllowExecute is enabled. The existing getCommandDecision() function already handles command chain parsing and longest-prefix-match conflict resolution, so the fix is minimal -- just calling it earlier in the flow.

The longest-prefix-match logic is preserved, so more specific allow entries (e.g., rm -i) can still override a broader deny entry (e.g., rm).

Test Procedure

• Added 8 new tests in checkAutoApproval.spec.ts covering:
  • Denied commands blocked when autoApprovalEnabled is false
  • Denied commands blocked when alwaysAllowExecute is false
  • Denied commands inside && chains are caught
  • The exact heredoc bypass scenario from the issue
  • Non-denied commands still get "ask" decision
  • Empty deny list does not block
  • Longest-prefix-match override still works
  • Undefined state returns "ask"
• Added 9 new tests in commands.spec.ts for getCommandDecision covering chained/wrapped command denial scenarios
• All 49 tests pass (3 test files)

Run tests: cd src && pnpm vitest run core/auto-approval/

Pre-Submission Checklist

• Issue Linked: This PR is linked to an approved GitHub Issue.
• Scope: Changes are focused on the linked issue.
• Self-Review: I have performed a thorough self-review of my code.
• Testing: New tests added to cover the changes.
• Documentation Impact: No documentation updates required.
• Contribution Guidelines: I have read and agree to the Contributor Guidelines.

Documentation Updates

• No documentation updates are required.

Additional Notes

The core change is a single 8-line block added to src/core/auto-approval/index.ts that checks denied commands before the auto-approval guard. The rest is test coverage.

Interactively review PR in Roo Code Cloud