From edf5b8d13fbcbed04bddeecbd54a4c266dc3876e Mon Sep 17 00:00:00 2001
From: fwh888 <fwh0709@qq.com>
Date: Sat, 1 Aug 2026 21:15:52 +0800
Subject: [PATCH] guardrails: block destructive commands in exec_command (fixes
 #952)

---
 strix/agents/factory.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/strix/agents/factory.py b/strix/agents/factory.py
index 5d922b19..bb896b77 100644
--- a/strix/agents/factory.py
+++ b/strix/agents/factory.py
@@ -16,6 +16,7 @@ from agents.tool import CustomTool, FunctionTool, Tool
 from pydantic import ValidationError
 
 from strix.agents.prompt import render_system_prompt
+from strix.agents.guardrails import check_destructive
 from strix.config import load_settings
 from strix.tools.agents_graph.tools import (
     agent_finish,
@@ -281,6 +282,10 @@ def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
             parsed = json.loads(raw_input)
         except (json.JSONDecodeError, TypeError):
             parsed = None
+        if isinstance(parsed, dict) and "cmd" in parsed:
+            reason = check_destructive(parsed.get("cmd", ""))
+            if reason:
+                return f"[guardrail] blocked destructive command: {reason}"
         if isinstance(parsed, dict):
             if "shell" not in parsed:
                 parsed["shell"] = "bash"