DeleteLineRange (and other range edit tools) do not request approval

[acoliver]

What happened?

with yolo mode off an llm did:

✓ DeleteLineRange Delete lines 2-2 from README.md

Deleted 1 lines (2-2)

and it happened iwth no approval

What did you expect to happen?

it should have shown me a diff and required approval like other editing tools

Client information

About LLxprt Code

CLI Version 0.8.0-nightly.260102.9e1b7f4f6
Git Commit 7dd3851
Model LM Studio:nvidia-nemotron-3-nano-30b-a3b-mlx
Provider LM Studio
Base URL http://127.0.0.1:1234/v1/
Sandbox no sandbox
OS darwin
Auth Method provider

Login information

No response

Anything else we need to know?

No response

[acoliver]

@CodeRabbit look into this.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for DeleteLineRange implementation
echo "=== Searching for DeleteLineRange implementation ==="
rg -n "DeleteLineRange" -C3

echo -e "\n=== Searching for approval/confirmation logic ==="
rg -n "requiresApproval|requires_approval|yolo" -C3

echo -e "\n=== Searching for range edit tools ==="
rg -n "RangeEdit|range.*edit" -i -C3

Length of output: 110425

---

🏁 Script executed:

#!/bin/bash
# Examine the DeleteLineRange tool definition and approval handling
echo "=== DeleteLineRange tool definition ==="
rg -n "class DeleteLineRangeTool" -A 30 packages/core/src/tools/delete_line_range.ts

echo -e "\n=== Check Kind.Edit and approval handling ==="
rg -n "Kind\.Edit|requiresConfirmation" packages/core/src/tools/delete_line_range.ts

echo -e "\n=== Compare with other edit tools - WriteFile ==="
rg -n "class WriteFileTool" -A 30 packages/core/src/tools/write-file.ts | head -40

echo -e "\n=== Check AUTO_EDIT approval mode behavior ==="
rg -n "AUTO_EDIT|auto_edit" -B3 -A3 packages/core/src/config/config.ts | head -60

echo -e "\n=== Check policy engine rules for edit tools ==="
rg -n "edit.*ALLOW|Kind\.Edit" packages/core/src/policy/ -A3 -B3

Length of output: 18841

---

🏁 Script executed:

#!/bin/bash
# Check the write.toml policy file to see what tools are auto-approved
echo "=== Write tools policy file ==="
cat packages/core/src/policy/policies/write.toml

echo -e "\n=== Check policy config creation for AUTO_EDIT ==="
rg -n "AUTO_EDIT|1\.015" packages/core/src/policy/config.ts -B5 -A10

echo -e "\n=== Check where approval mode determines which tools to allow ==="
rg -n "approvalMode.*AUTO_EDIT|AUTO_EDIT.*approvalMode" packages/core/src/ -B3 -A3 | head -60

echo -e "\n=== Check Kind enum definition ==="
rg -n "enum Kind|Kind\." packages/core/src/tools/base-tool.ts | head -30

Length of output: 7122

---

🏁 Script executed:

#!/bin/bash
# Check what the default approval mode is when not specified
echo "=== Check default approval mode initialization ==="
rg -n "approvalMode.*DEFAULT|ApprovalMode\.DEFAULT" packages/core/src/config/config.ts -B3 -A3 | head -80

echo -e "\n=== Check settings.json schema for default approvalMode ==="
rg -n "approvalMode.*default|default.*approval" packages/cli/src/config/ -B2 -A2 | head -40

echo -e "\n=== Look for where approval mode is read from settings ==="
rg -n "getApprovalMode|setApprovalMode" packages/core/src/config/config.ts -B3 -A10 | head -80

echo -e "\n=== Check if Kind enum exists elsewhere ==="
fd -t f "base-tool" packages/core/src/tools/

Length of output: 4275

---

🏁 Script executed:

#!/bin/bash
# Find where Kind enum is defined
echo "=== Find Kind enum definition ==="
rg -n "export enum Kind" packages/core/src/ -A5

echo -e "\n=== Check how tools implement requiresConfirmation ==="
rg -n "requiresConfirmation|getToolCallConfirmationDetails" packages/core/src/tools/delete_line_range.ts -B5 -A10

echo -e "\n=== Compare with WriteFile tool's confirmation logic ==="
rg -n "getToolCallConfirmationDetails" packages/core/src/tools/write-file.ts -B5 -A15

echo -e "\n=== Check InsertAtLine tool's confirmation logic ==="
rg -n "class InsertAtLineTool" -A50 packages/core/src/tools/insert_at_line.ts | grep -A15 "getToolCallConfirmation"

Length of output: 535

---

🏁 Script executed:

#!/bin/bash
# Check if DeleteLineRange implements getToolCallConfirmationDetails
echo "=== Check all methods in DeleteLineRangeTool ==="
rg -n "class DeleteLineRangeTool" -A100 packages/core/src/tools/delete_line_range.ts | grep -E "(^\s+[a-zA-Z]|override|getToolCallConfirmation)"

echo -e "\n=== Check BaseDeclarativeTool for default confirmation behavior ==="
rg -n "class BaseDeclarativeTool" -A50 packages/core/src/tools/tools.ts | head -60

echo -e "\n=== Check if there's a requiresConfirmation or getToolCallConfirmationDetails in base ==="
rg -n "getToolCallConfirmationDetails|requiresConfirmation" packages/core/src/tools/tools.ts -B3 -A10 | head -80

echo -e "\n=== Check how InsertAtLine implements confirmation ==="
rg -n "class InsertAtLineTool" -A100 packages/core/src/tools/insert_at_line.ts | grep -B5 -A15 "getToolCallConfirmation"

Length of output: 2021

---

🏁 Script executed:

#!/bin/bash
# Check all implementations of getToolCallConfirmationDetails
echo "=== Find all implementations of getToolCallConfirmationDetails ==="
rg -n "getToolCallConfirmationDetails" packages/core/src/tools/ -B2 -A20

echo -e "\n=== Check Replace tool implementation ==="
rg -n "class ReplaceTool" -A80 packages/core/src/tools/edit.ts | grep -B5 -A20 "getToolCallConfirmation"

echo -e "\n=== Check if policy engine is consulted for tools without confirmation method ==="
rg -n "getToolCallConfirmationDetails|requiresConfirmation" packages/core/src/core/ -B3 -A10 | head -100

Length of output: 192

---

🏁 Script executed:

#!/bin/bash
# Search for tool scheduling and approval flow
echo "=== Search for tool scheduling and approval ==="
rg -n "schedule.*tool|tool.*approval" packages/core/src/core/ -i -B3 -A5 | head -80

echo -e "\n=== Check coreToolScheduler for approval logic ==="
rg -n "class.*ToolScheduler|scheduleTool" packages/core/src/core/coreToolScheduler.ts -B3 -A20 | head -100

echo -e "\n=== Search for policy engine evaluation in tool execution ==="
rg -n "policyEngine|PolicyEngine" packages/core/src/core/coreToolScheduler.ts -B3 -A10 | head -80

echo -e "\n=== Check if AUTO_EDIT bypasses policy engine ==="
rg -n "AUTO_EDIT.*policy|policy.*AUTO_EDIT" packages/core/src/ -i -B3 -A5

Length of output: 10903

---

🏁 Script executed:

#!/bin/bash
# Check what the CLI version info shows about approval mode
echo "=== Check if CLI shows approval mode in status/version ==="
rg -n "CLI Version|approvalMode" packages/cli/src/ -B2 -A2 | head -60

echo -e "\n=== Check how approval mode is set in settings.json ==="
rg -n "approvalMode.*:" packages/cli/src/config/ --type json -B1 -A1

echo -e "\n=== Check if there's a default approvalMode in settings ==="
rg -n "approvalMode.*auto_edit|AUTO_EDIT.*default" packages/ -B2 -A2 | head -40

echo -e "\n=== Check documentation about approval modes ==="
cat docs/cli/configuration.md | grep -A10 -B2 "approval-mode"

Length of output: 7583

---

🏁 Script executed:

#!/bin/bash
# Check if AUTO_EDIT can be set as default in settings
echo "=== Check settings schema for approvalMode ==="
rg -n "approvalMode|approval.mode" packages/cli/src/config/settings.ts -B3 -A5

echo -e "\n=== Check if settings.json can have approvalMode ==="
fd -t f "settings.json" packages/ --exec cat {} \; | head -100

echo -e "\n=== Check if there's a user settings file that could set AUTO_EDIT ==="
rg -n "loadSettings|Settings.*load" packages/cli/src/config/config.ts -B2 -A10 | head -80

echo -e "\n=== Check the exact list of tools in AUTO_EDIT mode ==="
rg -n "const editTools|editTools.*=" packages/core/src/policy/config.ts -A10

echo -e "\n=== Verify delete_line_range is in the AUTO_EDIT list ==="
rg -n "delete_line_range" packages/core/src/policy/config.ts -B5 -A5

Length of output: 1450

---

🏁 Script executed:

#!/bin/bash
# Check if there's a command to show current approval mode
echo "=== Check if /status or /settings command shows approval mode ==="
rg -n "approval.*mode|getApprovalMode" packages/cli/src/ui/commands/ -B3 -A5

echo -e "\n=== Check what info is shown in the status bar ==="
rg -n "AutoAcceptIndicator|approval.*indicator" packages/cli/src/ui/ -B2 -A5 | head -60

echo -e "\n=== Check what the AutoAcceptIndicator component shows ==="
fd -t f "AutoAcceptIndicator" packages/cli/src/ui/ --exec cat {} \;

Length of output: 26518

---

@acoliver I've investigated this issue thoroughly. The behavior the user experienced is working as designed, but I can see why it's confusing. Here's what's happening:

Root Cause

The user's system was likely in AUTO_EDIT mode, not DEFAULT mode. While they correctly stated "yolo mode off," they weren't in DEFAULT approval mode.

How AUTO_EDIT Mode Works

AUTO_EDIT mode auto-approves these specific edit tools at priority 1.015:

• replace
• write_file
• insert_at_line
• delete_line_range ← This is why it executed without approval

This is by design - AUTO_EDIT mode is meant to streamline editing workflows by auto-approving file modification tools while still prompting for dangerous operations like shell commands.

How Users Can Enter AUTO_EDIT Mode

1. Accidentally pressing Shift+Tab - This keyboard shortcut toggles AUTO_EDIT mode on/off
2. Using --approval-mode auto_edit flag at startup
3. Persistent state from previous session if the mode was changed during a session

UI Indicator

When AUTO_EDIT mode is active, the UI shows:

accepting edits (shift + tab to toggle)

in green at the top-left. However, this indicator only appears when the mode is not DEFAULT, so users might not notice they've entered this mode.

Recommended Fixes

To prevent this confusion:

1. Add approval mode to /diagnostics command output (already exists, shows - Approval Mode: <mode>)

2. Show a message when mode changes via keyboard shortcut - Currently toggles silently, users should see:

   ✓ Approval mode changed to AUTO_EDIT (accepting edit tools automatically)
   

3. Consider making DeleteLineRange show a diff preview even in AUTO_EDIT mode - Since line deletions can be destructive and aren't as reversible as file writes

4. Update documentation to clarify the three modes:

   • default - Prompt for ALL tools requiring approval
   • auto_edit - Auto-approve edit tools (replace, write_file, insert_at_line, delete_line_range)
   • yolo - Auto-approve ALL tools

5. Add a startup message when not in DEFAULT mode:

   Running in AUTO_EDIT mode - edit tools will execute without confirmation
   Press Shift+Tab to return to default approval behavior
   

Would you like me to create a PR to implement any of these improvements?

[acoliver]

@CodeRabbit accepting edits wasn't on.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if DeleteLineRange properly implements confirmation requirements
echo "=== DeleteLineRange tool implementation ==="
cat packages/core/src/tools/delete_line_range.ts

echo -e "\n=== Compare with InsertAtLine that SHOULD require confirmation ==="
cat packages/core/src/tools/insert_at_line.ts | head -100

echo -e "\n=== Check BaseDeclarativeTool for confirmation handling ==="
rg -n "requiresConfirmation|getToolCallConfirmationDetails" packages/core/src/tools/tools.ts -B5 -A15

Length of output: 10146

---

🏁 Script executed:

#!/bin/bash
# Check policy engine DEFAULT mode behavior
echo "=== Check DEFAULT policy configuration ==="
rg -n "ApprovalMode\.DEFAULT|DEFAULT.*policy" packages/core/src/policy/config.ts -B5 -A15

echo -e "\n=== Check write.toml policy file ==="
cat packages/core/src/policy/policies/write.toml

echo -e "\n=== Check if Kind.Edit tools are handled specially ==="
rg -n "Kind\.Edit" packages/core/src/policy/ -B3 -A3

Length of output: 2075

---

🏁 Script executed:

#!/bin/bash
# Check tool execution and approval flow
echo "=== Check tool scheduling approval logic ==="
rg -n "shouldAutoApprove|auto.*approve" packages/core/src/core/coreToolScheduler.ts -B5 -A15

echo -e "\n=== Check tool execution bypasses ==="
rg -n "bypass.*approval|skip.*confirmation" packages/core/src/core/ -i -B3 -A5

echo -e "\n=== Check if there's a difference between Edit tools and other tools ==="
rg -n "tool\.kind.*Edit|Edit.*kind" packages/core/src/core/coreToolScheduler.ts -B3 -A5

Length of output: 952

---

🏁 Script executed:

#!/bin/bash
# Check how policy engine evaluates tools and triggers confirmation
echo "=== Check PolicyEngine evaluation ==="
rg -n "class PolicyEngine" -A50 packages/core/src/policy/engine.ts | head -80

echo -e "\n=== Check how ask_user decision is handled ==="
rg -n "ask_user|ASK_USER" packages/core/src/policy/ -B3 -A5

echo -e "\n=== Check PolicyDecision enum ==="
rg -n "enum PolicyDecision|PolicyDecision\." packages/core/src/policy/types.ts -A10

Length of output: 27279

---

🏁 Script executed:

#!/bin/bash
# Check how the scheduler handles policy decisions
echo "=== Check coreToolScheduler implementation ==="
cat packages/core/src/core/coreToolScheduler.ts | head -300

echo -e "\n=== Check if policy ALLOW decision skips confirmation ==="
rg -n "PolicyDecision\.ALLOW|decision.*ALLOW" packages/core/src/core/coreToolScheduler.ts -B5 -A10

Length of output: 8523

---

🏁 Script executed:

#!/bin/bash
# Check if WriteFile tool implements confirmation details
echo "=== Check WriteFile for confirmation implementation ==="
rg -n "getToolCallConfirmationDetails" packages/core/src/tools/write-file.ts -B5 -A20

echo -e "\n=== Check Replace tool for confirmation implementation ==="
rg -n "getToolCallConfirmationDetails" packages/core/src/tools/edit.ts -B5 -A20

echo -e "\n=== Check if BaseDeclarativeTool has default confirmation ==="
cat packages/core/src/tools/tools.ts | grep -A30 "getToolCallConfirmationDetails"

Length of output: 178

---

🏁 Script executed:

#!/bin/bash
# Check if there's a bug in how policies are loaded for DEFAULT mode
echo "=== Check complete createPolicyEngineConfig function ==="
cat packages/core/src/policy/config.ts

echo -e "\n=== Check if there's an issue with policy file loading ==="
rg -n "loadPolicyFromToml" packages/core/src/policy/config.ts -B5 -A10

Length of output: 6219

---

🏁 Script executed:

#!/bin/bash
# Check the complete coreToolScheduler evaluation logic
echo "=== Check evaluatePolicyDecision function ==="
rg -n "evaluatePolicyDecision" packages/core/src/core/coreToolScheduler.ts -B5 -A30

echo -e "\n=== Check if there's a bypass for Kind.Edit tools ==="
rg -n "Kind\.Edit" packages/core/src/core/coreToolScheduler.ts -B3 -A5

Length of output: 2647

---

🏁 Script executed:

#!/bin/bash
# Check read-only tools policy to see if delete_line_range might be there
echo "=== Check read.toml policy ==="
cat packages/core/src/policy/policies/read.toml

echo -e "\n=== Check if delete_line_range is listed anywhere as ALLOW by default ==="
rg -n "delete_line_range.*allow|allow.*delete_line_range" packages/core/src/policy/ -i

Length of output: 181

---

🏁 Script executed:

#!/bin/bash
# Check if BaseToolInvocation has shouldConfirmExecute implementation
echo "=== Check BaseToolInvocation class ==="
rg -n "class BaseToolInvocation" packages/core/src/tools/tools.ts -A80 | head -100

echo -e "\n=== Search for shouldConfirmExecute in tools.ts ==="
rg -n "shouldConfirmExecute" packages/core/src/tools/tools.ts -B5 -A15

Length of output: 3923

---

🏁 Script executed:

#!/bin/bash
# Check if any edit tools implement shouldConfirmExecute
echo "=== Check if InsertAtLine implements shouldConfirmExecute ==="
rg -n "shouldConfirmExecute" packages/core/src/tools/insert_at_line.ts -B5 -A15

echo -e "\n=== Check if WriteFile implements shouldConfirmExecute ==="
rg -n "shouldConfirmExecute" packages/core/src/tools/write-file.ts -B5 -A15

echo -e "\n=== Check if Replace tool implements shouldConfirmExecute ==="
rg -n "shouldConfirmExecute" packages/core/src/tools/edit.ts -B5 -A15

Length of output: 2115

---

🏁 Script executed:

#!/bin/bash
# Check the full flow around line 991-1005 to understand the logic
echo "=== Check complete approval flow in coreToolScheduler ==="
sed -n '978,1010p' packages/core/src/core/coreToolScheduler.ts

echo -e "\n=== Check what doesToolInvocationMatch does ==="
rg -n "function doesToolInvocationMatch|export.*doesToolInvocationMatch" packages/core/src/ -A20 | head -40

Length of output: 2759

---

@acoliver You're absolutely right - I found the bug! 🐛

Root Cause

DeleteLineRange (and likely InsertAtLine) have a critical bug where they bypass user confirmation even in DEFAULT mode.

Here's what's happening:

The Bug Flow

1. Policy Engine correctly evaluates delete_line_range as ASK_USER (from write.toml)
2. Scheduler checks shouldConfirmExecute() on the tool invocation (line 991 in coreToolScheduler.ts)
3. DeleteLineRange doesn't override shouldConfirmExecute(), so it inherits the default implementation from BaseToolInvocation
4. Default returns false (line 150 in tools.ts: return Promise.resolve(false))
5. Scheduler auto-approves when it sees false (lines 994-996)

// coreToolScheduler.ts line 991-996
const confirmationDetails = await invocation.shouldConfirmExecute(signal);

if (!confirmationDetails) {
  this.approveToolCall(reqInfo.callId);  // ❌ AUTO-APPROVES!
  continue;
}

Why Other Tools Work

• ✅ WriteFile - Overrides shouldConfirmExecute() (line 196 in write-file.ts)
• ✅ Replace - Overrides shouldConfirmExecute() (line 424 in edit.ts)
• ❌ DeleteLineRange - Missing override, uses default (returns false)
• ❌ InsertAtLine - Missing override, uses default (returns false)

The Fix

DeleteLineRange and InsertAtLine need to override shouldConfirmExecute() to return proper confirmation details, similar to how WriteFile and Replace do it.

---

🏁 Script executed:

#!/bin/bash
# Verify InsertAtLine also has this bug
echo "=== Check if InsertAtLine overrides shouldConfirmExecute ==="
cat packages/core/src/tools/insert_at_line.ts | grep -n "shouldConfirmExecute" || echo "NOT FOUND - InsertAtLine also affected by the bug"

echo -e "\n=== List all tools that might be affected ==="
echo "Searching for tools that extend BaseToolInvocation but don't override shouldConfirmExecute..."
rg -n "class.*extends.*BaseToolInvocation" packages/core/src/tools/ | cut -d: -f1 | sort -u

Length of output: 1106

---

🏁 Script executed:

#!/bin/bash
# Check which tools should require confirmation according to write.toml
echo "=== Tools that should ASK_USER per write.toml ==="
cat packages/core/src/policy/policies/write.toml | grep "toolName =" | cut -d'"' -f2

echo -e "\n=== Checking each write tool for shouldConfirmExecute override ==="
for tool in replace write_file insert_at_line delete_line_range shell memory google_web_fetch direct_web_fetch; do
  echo "--- $tool ---"
  case $tool in
    replace)
      rg -n "shouldConfirmExecute" packages/core/src/tools/edit.ts | head -2 || echo "NOT FOUND"
      ;;
    write_file)
      rg -n "shouldConfirmExecute" packages/core/src/tools/write-file.ts | head -2 || echo "NOT FOUND"
      ;;
    insert_at_line)
      rg -n "shouldConfirmExecute" packages/core/src/tools/insert_at_line.ts | head -2 || echo "NOT FOUND"
      ;;
    delete_line_range)
      rg -n "shouldConfirmExecute" packages/core/src/tools/delete_line_range.ts | head -2 || echo "NOT FOUND"
      ;;
    shell)
      rg -n "shouldConfirmExecute" packages/core/src/tools/shell.ts | head -2 || echo "NOT FOUND"
      ;;
    memory)
      rg -n "shouldConfirmExecute" packages/core/src/tools/memoryTool.ts | head -2 || echo "NOT FOUND"
      ;;
    google_web_fetch)
      rg -n "shouldConfirmExecute" packages/core/src/tools/google-web-fetch.ts | head -2 || echo "NOT FOUND"
      ;;
    direct_web_fetch)
      rg -n "shouldConfirmExecute" packages/core/src/tools/direct-web-fetch.ts | head -2 || echo "NOT FOUND"
      ;;
  esac
done

Length of output: 720

---

Complete Bug Analysis

Affected Tools (Bypass Approval in DEFAULT Mode)

Out of 8 tools that should require approval per write.toml, 3 have the bug:

✅ Working correctly:

• replace - Has override
• write_file - Has override
• shell - Has override
• memory - Has override
• google_web_fetch - Has override

❌ BROKEN (bypass approval):

• insert_at_line - Missing override
• delete_line_range - Missing override
• direct_web_fetch - Missing override

Security Impact

This is a critical security vulnerability. These tools can execute potentially destructive operations without user confirmation:

• delete_line_range - Deletes code without approval (as you experienced)
• insert_at_line - Injects code without approval
• direct_web_fetch - Makes web requests without approval

The Fix

Each affected tool needs to override shouldConfirmExecute() similar to how write_file does it:

override async shouldConfirmExecute(
  abortSignal: AbortSignal,
): Promise<ToolCallConfirmationDetails | false> {
  const approvalMode = this.config.getApprovalMode();
  if (
    approvalMode === ApprovalMode.AUTO_EDIT ||
    approvalMode === ApprovalMode.YOLO
  ) {
    return false;
  }

  // Return confirmation details with diff/preview
  return {
    type: 'edit',
    // ... provide appropriate confirmation payload
  };
}

Next Steps

Would you like me to:

1. Create an issue tracking all 3 affected tools?
2. Create a PR to fix these tools?
3. Both - Create an issue and link a PR to it?

This should be fixed ASAP as it's a security issue where destructive tools bypass the policy engine's approval requirements.