fix(keymap): list the Git log's Show Diff in the VS Code preset

#3065 bound vcs.log.changes.showDiff in the IntelliJ keymaps, and the VS Code
preset must name every IntelliJ action id (keymap.test.ts). VS Code has no Show
Diff key, so it gets none, like vcs.showDiff.

docs/en/guide/agents.mdx

@@ -71,7 +71,7 @@ On your own messages you can **Edit** (the messages after it are replaced; files
 
 When an agent wants to run a command or call a tool that needs approval, the task shows the request and is listed as **Needs Input**. Choose one of the options the agent offers, such as **Allow Once**, **Allow for This Session**, **Always Allow**, **Decline**, **Always Decline** or **Decline and Stop**. Many agents also have a mode picker that approves edits or everything automatically; use it with care.
 
-Once an agent has run a task, new tasks start in its mode that approves everything (Claude Code's bypass permissions, Codex's Full Access), and command permissions don't apply there. To start them in a mode that asks, set **Settings › Agents › Chat › New tasks start** to **Asking for approval**. Only your own settings choose this, never a project's.
+Once an agent has run a task, new tasks start in its mode that approves everything (Claude Code's bypass permissions, Codex's Full Access), and the Command Execution Policy doesn't apply there. To start them in a mode that asks, set **Settings › Agents › Chat › New tasks start** to **Asking for approval**. Only your own settings choose this, never a project's.
 
 ### Review the changes
 

docs/zh/guide/agents.mdx

@@ -71,7 +71,7 @@ OpenIDEA 本身不带模型或账号：它启动你已安装并登录的 agent
 
 agent 要运行命令或调用需要授权的工具时，任务中会显示请求，并归入 **等待输入**。从 agent 提供的选项中选择，例如 **允许一次**、**在此会话中允许**、**始终允许**、**拒绝**、**始终拒绝** 或 **拒绝并停止**。很多 agent 还有模式选择器，可以自动批准编辑甚至所有操作，请谨慎使用。
 
-agent 运行过一个任务后，新任务会以它自动批准所有操作的模式开始（Claude Code 的绕过权限、Codex 的完全访问），此时命令权限不生效。要让新任务以请求批准的模式开始，把 **设置 › 智能体 › 聊天 › 新任务开始时** 设为 **请求批准**。这一项只由你自己的设置决定，项目设置无法更改。
+agent 运行过一个任务后，新任务会以它自动批准所有操作的模式开始（Claude Code 的绕过权限、Codex 的完全访问），此时命令执行策略不生效。要让新任务以请求批准的模式开始，把 **设置 › 智能体 › 聊天 › 新任务开始时** 设为 **请求批准**。这一项只由你自己的设置决定，项目设置无法更改。
 
 ### 查看改动
 

src/features/agents/AgentPolicyPage.tsx

@@ -1,5 +1,5 @@
 /**
- * Settings › Tools › Agents › Command Permissions: whitelist (auto-approve)
+ * Settings › Tools › Agents › Command Execution Policy: whitelist (auto-approve)
  * and blacklist (auto-reject) command patterns evaluated on agent permission requests.
  */
 import { useMemo, useState } from "react";
@@ -47,18 +47,18 @@ export function AgentPolicyPage() {
   };
 
   return (
-    <section className={styles.body} aria-label="Command Permissions">
+    <section className={styles.body} aria-label="Command Execution Policy">
       <p className={styles.notice}>
         <T>
-          Allowed commands run without asking, with or without extra arguments. Blocked commands are always rejected,
-          even if allowed, and support * and ? wildcards. Commands with substitutions, redirections or variable
-          assignments always ask.
+          Allowed commands run without asking: an entry matches that command, alone or with more arguments. Commands
+          with substitutions, redirections or variable assignments always ask. Blocked commands are rejected and win
+          over allowed ones; they support the * and ? wildcards.
         </T>
       </p>
       <div className={styles.grid}>
         <div className={styles.column}>
           <div className={styles.columnTitle}>
-            <T>Allowed Commands</T>
+            <T>Allowed Commands (Whitelist)</T>
           </div>
           <div className={styles.items}>
             {policy.allowedCommands.map((pattern) => (
@@ -80,7 +80,7 @@ export function AgentPolicyPage() {
               value={allowDraft}
               onChange={(e) => setAllowDraft(e.target.value)}
               onKeyDown={(e) => e.key === "Enter" && addAllowed()}
-              placeholder={tx("e.g. cargo test")}
+              placeholder={tx("e.g. cargo test*")}
               aria-label="Allowed command pattern"
             />
             <Button size="small" aria-label="Add allowed command" onClick={addAllowed}>
@@ -90,7 +90,7 @@ export function AgentPolicyPage() {
         </div>
         <div className={styles.column}>
           <div className={styles.columnTitle}>
-            <T>Blocked Commands</T>
+            <T>Blocked Commands (Blacklist)</T>
           </div>
           <div className={styles.items}>
             {policy.blockedCommands.map((pattern) => (

src/features/agents/agentPolicy.test.tsx

@@ -32,7 +32,7 @@ function FormWrapper({ children }: { children: ReactNode }) {
   return <SettingsFormContext.Provider value={form}>{children}</SettingsFormContext.Provider>;
 }
 
-describe("Command Permissions sub-page", () => {
+describe("Command Execution Policy sub-page", () => {
   it("registers under Agents group in settings", () => {
     const dispose = activateSettingsPages();
     try {
@@ -40,7 +40,7 @@ describe("Command Permissions sub-page", () => {
       const agentsGroup = tree.find((n) => n.title === AGENTS_GROUP);
       expect(agentsGroup).toBeDefined();
       const policyNode = agentsGroup?.children.find((n) => n.key === POLICY_PAGE);
-      expect(policyNode?.title).toBe("Command Permissions");
+      expect(policyNode?.title).toBe("Command Execution Policy");
       // A project's settings file can't decide what agents run without asking.
       expect(policyNode?.page?.projectScope).not.toBe(true);
     } finally {
@@ -56,7 +56,7 @@ describe("Command Permissions sub-page", () => {
       </FormWrapper>,
     );
 
-    const policy = screen.getByRole("region", { name: "Command Permissions" });
+    const policy = screen.getByRole("region", { name: "Command Execution Policy" });
     expect(within(policy).getByText("rm -rf *")).toBeInTheDocument();
 
     fireEvent.change(within(policy).getByRole("textbox", { name: "Allowed command pattern" }), {

src/features/agents/index.ts

@@ -59,7 +59,7 @@ export function activateSettingsPages(): () => void {
     }),
     registerSettingsPage({
       id: POLICY_PAGE,
-      title: "Command Permissions",
+      title: "Command Execution Policy",
       group: AGENTS_GROUP,
       order: 490,
       keywords: ["agent", "policy", "security", "whitelist", "blacklist", "permission", "command", "exec"],

src/features/agents/model.ts

@@ -13,7 +13,7 @@ export const REGISTRY_PAGE = "agents.list";
 export const AGENTS_GROUP = "Agents";
 /** Settings › Agents › External MCP Servers: User and Workspace MCP configurations. */
 export const MCP_PAGE = "agents.mcpServers";
-/** Settings › Agents › Command Permissions. */
+/** Settings › Agents › Command Execution Policy. */
 export const POLICY_PAGE = "agents.policy";
 
 export const sessionKey = (task: string) => `agent:${task}`;

src/features/settings/pages/tools.tsx

@@ -682,7 +682,7 @@ export const TOOLS_PAGES: PageSpec[] = [
             key: "agents.newTaskApprovals",
             label: "New tasks start",
             options: NEW_TASK_APPROVAL_OPTIONS,
-            hint: "Without asking means the agent's bypass or full-access mode, where command permissions don't apply",
+            hint: "Without asking means the agent's bypass or full-access mode, where the Command Execution Policy doesn't apply",
           },
         ],
       },

src/platform/keymaps/vscode-macos.ts

@@ -300,6 +300,7 @@ export const vscodeMacos: Record<string, string[]> = {
   "vcs.rollback": [],
   "vcs.addToVcs": [],
   "vcs.showDiff": [],
+  "vcs.log.changes.showDiff": [],
   "vcs.showDiffInNewWindow": [],
   "vcs.nextChange": ["Alt+F5"],
   "vcs.prevChange": ["Alt+Shift+F5"],

src/platform/locales/text/en.json

@@ -1087,7 +1087,7 @@
   "New tasks start": "New tasks start",
   "Without asking for approval": "Without asking for approval",
   "Asking for approval": "Asking for approval",
-  "Without asking means the agent's bypass or full-access mode, where command permissions don't apply": "Without asking means the agent's bypass or full-access mode, where command permissions don't apply",
+  "Without asking means the agent's bypass or full-access mode, where the Command Execution Policy doesn't apply": "Without asking means the agent's bypass or full-access mode, where the Command Execution Policy doesn't apply",
   "Conversation": "Conversation",
   "Fold a finished turn's work": "Fold a finished turn's work",
   "Reasoning and tool calls before the reply fold into one line under its message": "Reasoning and tool calls before the reply fold into one line under its message",

src/platform/locales/text/zh.json

@@ -396,11 +396,11 @@
   "Custom executable": "自定义可执行文件",
   "Found on PATH": "已在 PATH 中找到",
   "Leave empty to find the executable on PATH. Changes apply to new sessions.": "留空以从 PATH 查找可执行文件。更改对新会话生效。",
-  "Command Permissions": "命令权限",
-  "Allowed commands run without asking, with or without extra arguments. Blocked commands are always rejected, even if allowed, and support * and ? wildcards. Commands with substitutions, redirections or variable assignments always ask.": "允许的命令直接运行，无需确认，可带额外参数。阻止的命令总会被拒绝，优先于允许列表，支持 * 和 ? 通配符。含命令替换、重定向或变量赋值的命令总会询问。",
-  "Allowed Commands": "允许的命令",
-  "Blocked Commands": "阻止的命令",
-  "e.g. cargo test": "例如 cargo test",
+  "Command Execution Policy": "命令执行策略",
+  "Allowed commands run without asking: an entry matches that command, alone or with more arguments. Commands with substitutions, redirections or variable assignments always ask. Blocked commands are rejected and win over allowed ones; they support the * and ? wildcards.": "允许的命令无需确认即可运行：条目匹配该命令本身或带更多参数的该命令。含命令替换、重定向或变量赋值的命令总会询问。阻止的命令会被拒绝，且优先于允许的命令；可使用 * 和 ? 通配符。",
+  "Allowed Commands (Whitelist)": "允许的命令（白名单）",
+  "Blocked Commands (Blacklist)": "阻止的命令（黑名单）",
+  "e.g. cargo test*": "例如 cargo test*",
   "e.g. rm -rf *": "例如 rm -rf *",
   "Add allowed command": "添加允许的命令",
   "Add blocked command": "添加阻止的命令",
@@ -7446,7 +7446,7 @@
   "New tasks start": "新任务开始时",
   "Without asking for approval": "不请求批准",
   "Asking for approval": "请求批准",
-  "Without asking means the agent's bypass or full-access mode, where command permissions don't apply": "不请求批准即使用智能体的绕过权限或完全访问模式，此时命令权限不生效",
+  "Without asking means the agent's bypass or full-access mode, where the Command Execution Policy doesn't apply": "不请求批准即使用智能体的绕过权限或完全访问模式，此时命令执行策略不生效",
   "Conversation": "对话",
   "Fold a finished turn's work": "折叠已完成回合的过程",
   "Reasoning and tool calls before the reply fold into one line under its message": "回复之前的思考和工具调用折叠成一行，显示在对应消息下方",
@@ -7458,7 +7458,7 @@
   "No checksum provided: the download can't be verified.": "未提供校验和：无法校验下载的文件。",
   "Sign In": "登录",
   "New Tasks": "新任务",
-  "Coding Agents": "编程智能体",
+  "Coding Agents": "编程 Agent",
   "Install coding agents and configure how they launch, chat and connect to the IDE.": "安装编程 Agent，并配置其启动方式、聊天行为以及与 IDE 的连接。",
   "Fork Agent Task": "Fork Agent 任务",
   "Couldn't fork the task": "无法 Fork 任务",