From 47dcd3c11e26d5bf39a54a150fdbac5ca08cfbf2 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Sun, 16 Aug 2026 18:52:51 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20run=5Fcommand=E5=8F=AA=E5=AF=B9=E5=8D=B1?=
 =?UTF-8?q?=E9=99=A9=E5=91=BD=E4=BB=A4=E7=A1=AE=E8=AE=A4(=E6=99=AE?=
 =?UTF-8?q?=E9=80=9A=E5=91=BD=E4=BB=A4=E8=87=AA=E5=8A=A8=E6=89=A7=E8=A1=8C?=
 =?UTF-8?q?),=E9=81=BF=E5=85=8Dconfirm=E5=8D=A1=E6=AD=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pipeline_service/agent_loop_v2.py | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/pipeline_service/agent_loop_v2.py b/pipeline_service/agent_loop_v2.py
index 02bf067..c0f2b90 100644
--- a/pipeline_service/agent_loop_v2.py
+++ b/pipeline_service/agent_loop_v2.py
@@ -173,7 +173,7 @@ class AgentExecutor:
                         tool_params = {}
 
                     # 需要确认的工具
-                    if self._needs_confirmation(tool_name):
+                    if self._needs_confirmation(tool_name, tool_params):
                         yield json.dumps({
                             "type": "confirm", "tool": tool_name, "params": tool_params,
                         }, ensure_ascii=False) + "\n"
@@ -233,7 +233,7 @@ class AgentExecutor:
                     tool_params = act.get("params", {})
 
                     # 需要确认的工具
-                    if self._needs_confirmation(tool_name):
+                    if self._needs_confirmation(tool_name, tool_params):
                         yield json.dumps({
                             "type": "confirm",
                             "tool": tool_name,
@@ -1201,11 +1201,24 @@ class AgentExecutor:
             pass
         return ""
 
-    def _needs_confirmation(self, tool_name: str) -> bool:
-        """检查工具是否需要用户确认"""
+    def _is_dangerous_command(self, cmd: str) -> bool:
+        """判断 shell 命令是否危险（run_command 只对危险命令要求确认）。"""
+        c = (cmd or "").strip().lower()
+        dangerous = (
+            "rm -rf", "rm -r", "sudo", "su ", "drop table", "drop database",
+            "truncate", "delete from", "mkfs", "dd if", ":(){", "shutdown",
+            "reboot", "kill -9", "chmod 777", "chown", "> /dev/",
+        )
+        return any(d in c for d in dangerous)
+
+    def _needs_confirmation(self, tool_name: str, params: dict = None) -> bool:
+        """检查工具是否需要用户确认。run_command 只对危险命令确认，普通命令自动执行。"""
         if self._tool_registry:
             tool = self._tool_registry.get(tool_name)
             if tool and tool.requires_confirmation:
+                if tool_name == "run_command":
+                    cmd = (params or {}).get("command", "")
+                    return self._is_dangerous_command(cmd)
                 return True
         return False