From 1c62971dc3cb16fa167b9497067a6d7e987df532 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=BE=99=200668001470?= <li.long15@xydigit.com>
Date: Mon, 16 Mar 2026 09:16:34 +0800
Subject: [PATCH] refactor(shell): move path boundary guard after safe-path
 check

---
 pkg/tools/shell.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index c23734577..994535462 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -407,10 +407,6 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				}
 			}
 
-			if !isPathBoundary(cmd, loc[0]) {
-				continue
-			}
-
 			p, err := filepath.Abs(raw)
 			if err != nil {
 				continue
@@ -420,6 +416,10 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				continue
 			}
 
+			if !isPathBoundary(cmd, loc[0]) {
+				continue
+			}
+
 			rel, err := filepath.Rel(cwdPath, p)
 			if err != nil {
 				continue