From c297a578079ed50e21745130d271bc5bb848157e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=BE=99=200668001470?= <li.long15@xydigit.com>
Date: Mon, 16 Mar 2026 15:33:55 +0800
Subject: [PATCH] fix(exec): fail closed on file URI and cross-volume paths

---
 pkg/tools/shell.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index 2cbca23ae..198be6d3f 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -441,6 +441,14 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
 				continue
 			}
 
+			if runtime.GOOS == "windows" {
+				pathVolume := filepath.VolumeName(p)
+				cwdVolume := filepath.VolumeName(cwdPath)
+				if pathVolume != "" && cwdVolume != "" && !strings.EqualFold(pathVolume, cwdVolume) {
+					return "Command blocked by safety guard (path outside working dir)"
+				}
+			}
+
 			rel, err := filepath.Rel(cwdPath, p)
 			if err != nil {
 				continue