Fix implementations to use the correct tool names.

Add missing patterns from PR 6569 Add README.mds
Reapor-Yurnero · Feb 1, 2026 · Feb 1, 2026 · Feb 1, 2026 · Feb 1, 2026 · Feb 1, 2026
commit 87c605144370c4d9b2eaa3085d644ea906660dee
diff --git a/extensions/command-safety-guard/README.md b/extensions/command-safety-guard/README.md
@@ -0,0 +1,102 @@
+# Command Safety Guard
+
+Blocks execution of potentially destructive shell commands before they run.
+
+## What this does
+
+This guardrail plugin intercepts `exec` tool calls and checks the command against a set of dangerous patterns. It prevents catastrophic operations like:
+
+- Recursive forced deletion (`rm -rf /`)
+- Direct disk writes (`dd of=/dev/sda`)
+- Fork bombs and resource exhaustion
+- Privilege escalation attempts
+- Data exfiltration via network tools
+
+## Built-in rules
+
+| Rule ID | Description | Severity |
+|---------|-------------|----------|
+| `rm-recursive-force` | `rm -rf` or `rm -fr` flags | error |
+| `rm-root` | Deletion targeting `/`, `/bin`, `/usr`, `/etc`, `/var`, `/home`, `/opt`, `/Users`, `~`, `$HOME` | error |
+| `rm-current-dir` | Deleting `.`, `..`, or `.*` | error |
+| `rm-all-files` | Deleting `*` in current directory | error |
+| `find-delete-root` | `find / ... -delete` | error |
+| `dd-device` | `dd` writing to `/dev/` | error |
+| `mkfs` | Filesystem creation | error |
+| `format-disk` | `fdisk`, `parted`, `gdisk` on `/dev/` | error |
+| `shutdown-reboot` | `shutdown`, `reboot`, `poweroff`, `halt`, `init 0/6` | error |
+| `chmod-recursive-permissive` | `chmod -R 777` | warning |
+| `chmod-any-permissive` | Any `chmod 777` | warning |
+| `chmod-remove-perms` | `chmod 000` on `/bin`, `/usr`, `/etc` | error |
+| `chown-recursive-root` | `chown -R root` on sensitive paths | error |
+| `chown-root-dir` | `chown -R` on `/` | error |
+| `fork-bomb` | Fork bomb pattern `:(){ :|:& };:` | error |
+| `infinite-loop-yes` | `yes \|` infinite output | warning |
+| `curl-upload` | Uploading files via `curl -F`, `--form`, `-d`, etc. | warning |
+| `nc-listener` | Netcat listener or reverse shell | error |
+| `base64-pipe-curl` | Base64 piped to network commands | warning |
+| `curl-pipe-interpreter` | `curl/wget ... \| bash/python/etc` | error |
+| `cat-ssh-keys` | Reading SSH private keys | error |
+| `cat-env-credentials` | Reading `.env`, `.netrc`, `.aws/credentials`, `.npmrc` | error |
+| `history-clear` | Clearing shell history | warning |
+| `shred-logs` | Shredding log files | error |
+| `sudo-passwd` | `sudo passwd` | error |
+| `visudo-echo` | `echo ... > /etc/sudoers` | error |
+| `system-file-overwrite` | `> /etc/passwd`, `/etc/shadow`, `/etc/group` | error |
+| `git-no-verify` | `git commit --no-verify` | error |
+| `docker-prune-all` | `docker system prune -a --volumes` | error |
+
+## Configuration
+
+```jsonc
+{
+  "plugins": {
+    "command-safety-guard": {
+      // Allow commands through if evaluation fails (default: true)
+      "failOpen": true,
+
+      // Additional regex patterns to block
+      "extraPatterns": [
+        "\\bkubectl\\s+delete\\s+namespace"
+      ],
+
+      // Patterns to allow even if they match block rules
+      "allowPatterns": [
+        "rm -rf ./node_modules"
+      ],
+
+      // Disable specific built-in rules
+      "disabledRules": [
+        "infinite-loop-yes"
+      ],
+
+      // Stage configuration
+      "stages": {
+        "beforeToolCall": {
+          "enabled": true,
+          "mode": "block"  // or "monitor" to log without blocking
+        }
+      }
+    }
+  }
+}
+```
+
+## False positive handling
+
+The plugin strips quoted strings before pattern matching to reduce false positives. For example, this command will **not** be blocked:
+
+```bash
+echo "To delete everything, run: rm -rf /"
+```
+
+Only actual dangerous commands outside of quotes are flagged.
+
+## Severity levels
+
+- **error**: Command is blocked immediately
+- **warning**: Command is blocked in `block` mode, logged in `monitor` mode
+
+## Related
+
+- [security-audit](../security-audit/) - Blocks access to sensitive files and credentials
diff --git a/extensions/command-safety-guard/index.ts b/extensions/command-safety-guard/index.ts
@@ -58,7 +58,25 @@ const BUILT_IN_RULES: CommandRule[] = [
   {
     id: "rm-root",
     description: "Deletion targeting root or system paths",
-    pattern: /\brm\s+.*\s+(\/|\/\*|\/bin|\/usr|\/etc|\/var|\/home|\~)\s*$/,
+    pattern: /\brm\s+.*\s+(\/|\/\*|\/bin|\/usr|\/etc|\/var|\/home|\/opt|\/Users|\~|\$HOME)\s*$/,
+    severity: "error",
+  },
+  {
+    id: "rm-current-dir",
+    description: "Deleting current directory or all hidden files",
+    pattern: /\brm\s+(-[a-zA-Z]*\s+)*(\.|\.\.|\.\*)(\s|$)/,
+    severity: "error",
+  },
+  {
+    id: "rm-all-files",
+    description: "Deleting all files in current directory",
+    pattern: /\brm\s+(-[a-zA-Z]*\s+)*\*(\s|$)/,
+    severity: "error",
+  },
+  {
+    id: "find-delete-root",
+    description: "Recursive deletion from root directory",
+    pattern: /\bfind\s+\/\s+.*-delete/,
     severity: "error",
   },
   {
@@ -93,12 +111,30 @@ const BUILT_IN_RULES: CommandRule[] = [
     pattern: /\bchmod\s+(-R|--recursive)\s+777\b/,
     severity: "warning",
   },
+  {
+    id: "chmod-any-permissive",
+    description: "chmod 777 is a security risk",
+    pattern: /\bchmod\s+777\b/,
+    severity: "warning",
+  },
+  {
+    id: "chmod-remove-perms",
+    description: "Removing permissions on system directories",
+    pattern: /\bchmod\s+(-R\s+)?000\s+\/(bin|usr|etc)(\s|$)/,
+    severity: "error",
+  },
   {
     id: "chown-recursive-root",
     description: "Recursive chown to root on sensitive paths",
     pattern: /\bchown\s+(-R|--recursive)\s+root[:\s].*\s+(\/|\/home|\/etc)\b/,
     severity: "error",
   },
+  {
+    id: "chown-root-dir",
+    description: "Changing ownership of root directory",
+    pattern: /\bchown\s+(-R\s+).*\/(\s|$)/,
+    severity: "error",
+  },
 
   // Fork bombs and resource exhaustion
   {
@@ -118,7 +154,8 @@ const BUILT_IN_RULES: CommandRule[] = [
   {
     id: "curl-upload",
     description: "Uploading files via curl",
-    pattern: /\bcurl\b.*(-F|--form|-d|--data|--data-binary|-T|--upload-file)\b.*(@|<)/,
+    pattern:
+      /\bcurl\b.*(-F|--form|-d|--data|--data-binary|-T|--upload-file)\b.*(@|<)/,
     severity: "warning",
   },
   {
@@ -133,27 +170,36 @@ const BUILT_IN_RULES: CommandRule[] = [
     pattern: /\bbase64\b.*\|\s*(curl|wget|nc|netcat)/,
     severity: "warning",
   },
+  {
+    id: "curl-pipe-interpreter",
+    description: "Piping remote content to interpreters",
+    pattern: /(curl|wget)\s+[^|]*\|\s*(sudo\s+)?(bash|sh|python|ruby|perl)/,
+    severity: "error",
+  },
 
   // Credential/key exposure
   {
     id: "cat-ssh-keys",
     description: "Reading SSH private keys",
     // Match SSH private keys but exclude .pub files (negative lookahead)
-    pattern: /\b(cat|head|tail|less|more)\s+[^\n]*(\/\.ssh\/(id_[a-z0-9]+|[a-z0-9_]+_key)(?!\.pub)|\/\.gnupg\/)(\s|$)/,
+    pattern:
+      /\b(cat|head|tail|less|more)\s+[^\n]*(\/\.ssh\/(id_[a-z0-9]+|[a-z0-9_]+_key)(?!\.pub)|\/\.gnupg\/)(\s|$)/,
     severity: "error",
   },
   {
     id: "cat-env-credentials",
     description: "Reading credential files",
-    pattern: /\b(cat|head|tail|less|more)\s+.*\/(\.env|\.netrc|\.aws\/credentials|\.npmrc)/,
+    pattern:
+      /\b(cat|head|tail|less|more)\s+.*\/(\.env|\.netrc|\.aws\/credentials|\.npmrc)/,
     severity: "error",
   },
 
   // History and audit evasion
   {
     id: "history-clear",
     description: "Clearing shell history",
-    pattern: /\b(history\s+-c|>\s*~?\/?\.?\.?(bash_|zsh_)?history|unset\s+HISTFILE)\b/,
+    pattern:
+      /\b(history\s+-c|>\s*~?\/?\.?\.?(bash_|zsh_)?history|unset\s+HISTFILE)\b/,
     severity: "warning",
   },
   {
@@ -176,6 +222,28 @@ const BUILT_IN_RULES: CommandRule[] = [
     pattern: /\becho\b.*>.*\/etc\/sudoers/,
     severity: "error",
   },
+  {
+    id: "system-file-overwrite",
+    description: "Overwriting critical system files",
+    pattern: />\s*\/etc\/(passwd|shadow|group)/,
+    severity: "error",
+  },
+
+  // Version control safety
+  {
+    id: "git-no-verify",
+    description: "git commit --no-verify bypasses hooks",
+    pattern: /\bgit\s+commit\b.*--no-verify/,
+    severity: "error",
+  },
+
+  // Container safety
+  {
+    id: "docker-prune-all",
+    description: "Wiping all Docker data including volumes",
+    pattern: /docker\s+system\s+prune\s+-a.*--volumes/,
+    severity: "error",
+  },
 ];
 
 // ============================================================================
@@ -205,6 +273,14 @@ function compilePatterns(patterns: string[]): RegExp[] {
     .filter((p): p is RegExp => p !== null);
 }
 
+/**
+ * Remove quoted strings to reduce false positives.
+ * Commands inside quotes (e.g. echo "rm -rf /") are less likely to be dangerous.
+ */
+function stripQuotedStrings(cmd: string): string {
+  return cmd.replace(/'[^']*'/g, "").replace(/"[^"]*"/g, "");
+}
+
 // ============================================================================
 // Plugin Definition
 // ============================================================================
@@ -224,7 +300,8 @@ const commandSafetyGuardPlugin = createGuardrailPlugin<CommandSafetyConfig>({
       return { safe: true };
     }
 
-    if (ctx.metadata.toolName !== "Bash") {
+    // Tool name is lowercase "exec" (not "Bash")
+    if (ctx.metadata.toolName !== "exec") {
       return { safe: true };
     }
 
@@ -233,7 +310,10 @@ const commandSafetyGuardPlugin = createGuardrailPlugin<CommandSafetyConfig>({
       return { safe: true };
     }
 
-    // Check allow patterns first (escape hatch)
+    // Strip quoted strings to reduce false positives (e.g. echo "rm -rf /")
+    const cleanedCommand = stripQuotedStrings(command);
+
+    // Check allow patterns first (escape hatch) — use original command for allowlist
     if (config.allowPatterns && config.allowPatterns.length > 0) {
       const allowRegexes = compilePatterns(config.allowPatterns);
       if (matchesAnyPattern(command, allowRegexes)) {
@@ -244,7 +324,7 @@ const commandSafetyGuardPlugin = createGuardrailPlugin<CommandSafetyConfig>({
     // Check extra block patterns from config
     if (config.extraPatterns && config.extraPatterns.length > 0) {
       const extraRegexes = compilePatterns(config.extraPatterns);
-      if (matchesAnyPattern(command, extraRegexes)) {
+      if (matchesAnyPattern(cleanedCommand, extraRegexes)) {
         return {
           safe: false,
           reason: "Command matches custom block pattern",
@@ -259,7 +339,7 @@ const commandSafetyGuardPlugin = createGuardrailPlugin<CommandSafetyConfig>({
       if (disabledRules.has(rule.id)) {
         continue;
       }
-      if (rule.pattern.test(command)) {
+      if (rule.pattern.test(cleanedCommand)) {
         return {
           safe: false,
           reason: rule.description,
@@ -275,16 +355,19 @@ const commandSafetyGuardPlugin = createGuardrailPlugin<CommandSafetyConfig>({
     return { safe: true };
   },
 
-  formatViolationMessage(evaluation: GuardrailEvaluation, location: string): string {
-    const details = evaluation.details as {
-      command?: string;
-      ruleId?: string;
-      severity?: string;
-    } | undefined;
+  formatViolationMessage(
+    evaluation: GuardrailEvaluation,
+    location: string,
+  ): string {
+    const details = evaluation.details as
+      | {
+          command?: string;
+          ruleId?: string;
+          severity?: string;
+        }
+      | undefined;
 
-    const parts = [
-      `Command blocked by safety guard: ${evaluation.reason}.`,
-    ];
+    const parts = [`Command blocked by safety guard: ${evaluation.reason}.`];
 
     if (details?.ruleId) {
       parts.push(`Rule: ${details.ruleId}.`);
@@ -311,5 +394,5 @@ const pluginWithSchema = {
 export default pluginWithSchema;
 
 // Export for testing
-export { BUILT_IN_RULES, extractBashCommand };
+export { BUILT_IN_RULES, extractBashCommand, stripQuotedStrings };
 export type { CommandSafetyConfig, CommandRule };