From 3981a1a58ed888cfeb01a001243a330fb4aa2f07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=BE=99=200668001470?= <li.long15@xydigit.com>
Date: Mon, 16 Mar 2026 08:49:01 +0800
Subject: [PATCH] fix(exec): move boundary check after URL filtering

---
 pkg/tools/shell.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index c6bc8f7e8..c23734577 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -384,15 +384,13 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 		matchIndices := absolutePathPattern.FindAllStringIndex(cmd, -1)
 
 		for _, loc := range matchIndices {
-			if !isPathBoundary(cmd, loc[0]) {
-				continue
-			}
-
 			raw := cmd[loc[0]:loc[1]]
 
 			// Skip URL path components that look like they're from web URLs.
 			// When a URL like "https://github.com" is parsed, the regex captures
 			// "//github.com" as a match (the path portion after "https:").
+			// Use the exact match position (loc[0]) so that duplicate //path substrings
+			// in the same command are each evaluated at their own position.
 			if strings.HasPrefix(raw, "//") && loc[0] > 0 {
 				before := cmd[:loc[0]]
 				isWebURL := false
@@ -409,6 +407,10 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				}
 			}
 
+			if !isPathBoundary(cmd, loc[0]) {
+				continue
+			}
+
 			p, err := filepath.Abs(raw)
 			if err != nil {
 				continue