删除是批准过的，路径却错了

## Resolve and check every delete target
- Before any recursive delete or "clear" (`rm -r`, `rmdir /s`, `Remove-Item -Recurse`, `venv --clear`,
  `git clean`, `shutil.rmtree`), resolve the target to an absolute path and print it.
- Refuse if the target is empty, `/`, a drive root, `~`/home, the current working directory, the repo
  root, or any parent of the repo. Use `${VAR:?}` in shell so an empty variable aborts.
- Delete only inside an allowlist of disposable locations (a `mktemp -d` dir or a named build output).
  Never write guards as "anything outside X is allowed".
- Test destructive code with a temp directory or an injected delete function, never a real path.
- If a command fails with "No such file or directory" right after a delete, stop everything and tell the user.

## Resolve and check every delete target
- Before any recursive delete or "clear" (`rm -r`, `rmdir /s`, `Remove-Item -Recurse`, `venv --clear`,
  `git clean`, `shutil.rmtree`), resolve the target to an absolute path and print it.
- Refuse if the target is empty, `/`, a drive root, `~`/home, the current working directory, the repo
  root, or any parent of the repo. Use `${VAR:?}` in shell so an empty variable aborts.
- Delete only inside an allowlist of disposable locations (a `mktemp -d` dir or a named build output).
  Never write guards as "anything outside X is allowed".
- Test destructive code with a temp directory or an injected delete function, never a real path.
- If a command fails with "No such file or directory" right after a delete, stop everything and tell the user.

---
description: "AgentFails: The delete was approved. The path was wrong."
alwaysApply: true
---

## Resolve and check every delete target
- Before any recursive delete or "clear" (`rm -r`, `rmdir /s`, `Remove-Item -Recurse`, `venv --clear`,
  `git clean`, `shutil.rmtree`), resolve the target to an absolute path and print it.
- Refuse if the target is empty, `/`, a drive root, `~`/home, the current working directory, the repo
  root, or any parent of the repo. Use `${VAR:?}` in shell so an empty variable aborts.
- Delete only inside an allowlist of disposable locations (a `mktemp -d` dir or a named build output).
  Never write guards as "anything outside X is allowed".
- Test destructive code with a temp directory or an injected delete function, never a real path.
- If a command fails with "No such file or directory" right after a delete, stop everything and tell the user.

#!/usr/bin/env python3
"""Block recursive deletes/clears whose target is empty, a root, home, or a parent dir."""
import json, re, sys

call = json.load(sys.stdin)
if call.get("tool_name") != "Bash":
    sys.exit(0)
cmd = call["tool_input"].get("command", "")

deletes = r"(\brm\s+-\S*r|\brmdir\s+/s|Remove-Item\b.*-Recurse|venv\s+.*--clear|shutil\.rmtree)"
bad_target = r"(\"\"|''|\s/\s*$|\s/[\s;&|]|\s~/?(\s|$)|\$HOME/?(\s|$|\")|\s\.\.(/|\s|$)|\s[A-Za-z]:\\?(\s|$|\"))"
if re.search(deletes, cmd) and re.search(bad_target, cmd):
    print("BLOCKED: delete target is empty, a root, home, or a parent directory. "
          "Resolve the absolute path, show it to the user, and ask.", file=sys.stderr)
    sys.exit(2)
if re.search(r"\brm\s+-\S*r\S*\s+\"?\$\{?\w+\}?/", cmd) and ":?" not in cmd:
    print("BLOCKED: use ${VAR:?} so an empty variable cannot expand to /.", file=sys.stderr)
    sys.exit(2)
sys.exit(0)

#!/usr/bin/env python3
"""Block high-blast-radius shell commands; the agent must ask the user instead."""
import json, re, sys

call = json.load(sys.stdin)
if call.get("tool_name") != "Bash":
    sys.exit(0)
cmd = call["tool_input"].get("command", "")

dangerous = [
    r"\brm\s+-[a-zA-Z]*r[a-zA-Z]*f|\brm\s+-[a-zA-Z]*f[a-zA-Z]*r",   # rm -rf / rm -fr
    r"\bgit\s+push\b.*(--force\b|-f\b|--force-with-lease)",
    r"\bgit\s+reset\s+--hard\b",
    r"\bgit\s+clean\s+-[a-zA-Z]*f",
    r"\bgit\s+checkout\s+--\s+\.",
    r"\b(drop|truncate)\s+(table|database|schema)\b",
    r"\bdelete\s+from\s+\w+\s*;?\s*$",                              # DELETE without WHERE
    r"\b(terraform|tofu)\s+destroy\b",
    r"\bkubectl\s+delete\b",
]
for pat in dangerous:
    if re.search(pat, cmd, re.IGNORECASE):
        print(f"BLOCKED destructive command: {cmd!r}\n"
              "Explain what you want to run and why, and let the user run it or approve it.", file=sys.stderr)
        sys.exit(2)
sys.exit(0)