Powershell tools trigger security alerts

[tkooser]

Describe the bug

Whenever I use GitHub Copilot CLI I get IMs from Security Operations saying my machine is triggering alerts.
Specifically, it looks like Elastic has a built-in rule called "Clearing Windows Console History" that looks for Powershell commands with Set-PSReadLineOption and SaveNothing. It appears GitHub Copilot CLI does this for at least some Powershell tool invocations.

Affected version

GitHub Copilot CLI 0.0.406

Steps to reproduce the behavior

1. Run a prompt that will invoke Powershell.
2. See a new process spawned pwsh.exe -nop -nol -noe -c Set-PSReadLineOption -HistorySaveStyle SaveNothing

Expected behavior

GitHub Copilot CLI should not explicitly disable or clear Powershell command history

Additional context

Operating System: Windows 11
Terminal: Windows Terminal
Shell: Powershell 7.5.4

[bhujadesanket9]

https://github.com/github/copilot-cli.git