feat(agent-core-v2): require approval for dangerous bash commands in all permission modes

.changeset/dangerous-command-ask.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Block dangerous shell commands such as shutdown, reboot, or rm -rf in Auto mode, and always ask before running them in Manual and YOLO modes; disable the guard with `[permission] dangerous_command_guard = false` or `KIMI_CODE_DANGEROUS_COMMAND_GUARD=false`.

apps/kimi-code/src/cli/v2/run-v2-print.ts

@@ -148,6 +148,7 @@ export async function runV2Print(
       clientIdentity: identity,
       args: {
         requestHeaders: hostHeaders,
+        nonInteractive: true,
         // `--skillsDir` (v1 print parity): explicit skill dirs replace default
         // user / project discovery for this process.
         skillDirs: opts.skillsDirs,

apps/kimi-code/src/tui/commands/registry.ts

@@ -155,7 +155,7 @@ export const BUILTIN_SLASH_COMMANDS = [
   {
     name: 'auto',
     aliases: [],
-    description: 'Toggle Auto mode: fully autonomous, agent decides everything without asking.',
+    description: 'Toggle Auto mode: fully autonomous, but dangerous commands are blocked.',
     priority: 99,
     availability: 'always',
   },

apps/kimi-code/src/tui/components/dialogs/permission-selector.ts

@@ -16,7 +16,7 @@ const PERMISSION_OPTIONS: readonly ChoiceOption[] = [
   {
     value: 'auto',
     label: 'Auto',
-    description: 'Fully autonomous — agent decides everything without asking.',
+    description: 'Fully autonomous, but dangerous commands are blocked.',
   },
 ];
 

docs/en/configuration/config-files.md

@@ -98,7 +98,7 @@ Fields in the config file fall into two categories: **top-level scalars** that d
 | Field | Type | Default | Description |
 | --- | --- | --- | --- |
 | `default_model` | `string` | — | Default model alias; must be defined in `models` |
-| `default_permission_mode` | `string` | `manual` | Default permission mode for new sessions; one of `manual` (prompt each time), `yolo` (auto-approve tool actions, but the agent may still ask questions), or `auto` (fully autonomous — the agent decides everything without asking) |
+| `default_permission_mode` | `string` | `manual` | Default permission mode for new sessions; one of `manual` (prompt each time), `yolo` (auto-approve tool actions, but the agent may still ask questions), or `auto` (fully autonomous, but dangerous commands are always blocked) |
 | `default_plan_mode` | `boolean` | `false` | Whether new sessions start in Plan mode (produce a plan before executing) by default |
 | `merge_all_available_skills` | `boolean` | `true` | Whether to merge Agent Skills from all available directories |
 | `extra_skill_dirs` | `array<string>` | — | Extra skill search directories, layered on top of the default directories |
@@ -479,6 +479,8 @@ api_key = "sk-xxx"
 
 `permission` sets permission rules that are automatically loaded when a session starts, controlling whether the Agent needs user confirmation before calling a tool. Rules are written as a `[[permission.rules]]` array of tables, matched in order — the first matching rule takes effect.
 
+You can also set `dangerous_command_guard = false` under `[permission]` to turn off the built-in dangerous-command policy entirely (no dangerous-command ask or auto-mode deny); the default is `true`. An environment variable `KIMI_CODE_DANGEROUS_COMMAND_GUARD=false` overrides the file setting and restores the behavior before the policy was introduced. Use this switch only for environments that already gate commands outside the agent.
+
 | Field | Type | Required | Description |
 | --- | --- | --- | --- |
 | `decision` | `string` | Yes | Action on match: `allow` (permit immediately), `deny` (reject immediately), `ask` (prompt each time) |

docs/en/guides/interaction.md

@@ -62,9 +62,9 @@ Approvals are not triggered for regular tool calls in YOLO mode, nor for writes
 
 ### YOLO / Auto mode
 
-**YOLO mode** (`/yolo`) auto-approves regular tool calls, making it suitable for batch tasks you know are safe. It still asks before sensitive actions — accessing sensitive files such as `.env` or SSH keys, or exiting Plan mode — and the agent can still ask you questions.
+**YOLO mode** (`/yolo`) auto-approves regular tool calls, making it suitable for batch tasks you know are safe. It still asks before sensitive actions — accessing sensitive files such as `.env` or SSH keys, running dangerous commands such as `shutdown` or `rm -rf`, or exiting Plan mode — and the agent can still ask you questions.
 
-**Auto mode** (`/auto`) is the fully unattended mode: every tool approval is handled automatically, including sensitive files and plan exits, and the agent never asks you questions — it decides everything on its own.
+**Auto mode** (`/auto`) is the fully unattended mode: every tool approval is handled automatically, including sensitive files and plan exits, and the agent never asks you questions — it decides everything on its own. The only exception is the built-in dangerous-command guard: commands such as `shutdown`, `reboot`, or `rm -rf` are always blocked in Auto mode, and always require your confirmation in Manual and YOLO mode.
 
 
 ## Mode switching

docs/zh/configuration/config-files.md

@@ -98,7 +98,7 @@ timeout = 5
 | 字段 | 类型 | 默认值 | 说明 |
 | --- | --- | --- | --- |
 | `default_model` | `string` | — | 默认模型别名，必须在 `models` 中定义 |
-| `default_permission_mode` | `string` | `manual` | 新会话的默认权限模式，可选 `manual`（逐次询问）、`yolo`（自动批准工具操作，Agent 仍可能提问）、`auto`（完全自主，Agent 自己做决定，不再提问） |
+| `default_permission_mode` | `string` | `manual` | 新会话的默认权限模式，可选 `manual`（逐次询问）、`yolo`（自动批准工具操作，Agent 仍可能提问）、`auto`（完全自主，但危险命令始终被拒绝） |
 | `default_plan_mode` | `boolean` | `false` | 新会话是否默认以 Plan 模式（先出计划再执行）启动 |
 | `merge_all_available_skills` | `boolean` | `true` | 是否合并所有目录中的 Agent Skills |
 | `extra_skill_dirs` | `array<string>` | — | 额外 Skill 搜索目录，叠加到默认目录之上 |
@@ -478,6 +478,8 @@ api_key = "sk-xxx"
 
 `permission` 设置会话启动时自动加载的权限规则，控制 Agent 调用工具时是否需要用户确认。规则用 `[[permission.rules]]` 数组表写出，按顺序匹配，第一条命中即生效。
 
+也可以在 `[permission]` 下设置 `dangerous_command_guard = false` 完全关闭内置危险命令策略（不再触发危险命令审批或 auto 模式拒绝），默认 `true`。环境变量 `KIMI_CODE_DANGEROUS_COMMAND_GUARD=false` 会覆盖文件设置并恢复策略引入前的行为。此开关只适用于已经在 Agent 之外统一命令限权的环境。
+
 | 字段 | 类型 | 必填 | 说明 |
 | --- | --- | --- | --- |
 | `decision` | `string` | 是 | 匹配后的处置：`allow`（直接放行）、`deny`（直接拒绝）、`ask`（每次询问） |

docs/zh/guides/interaction.md

@@ -62,9 +62,9 @@ YOLO 模式下的普通工具调用、Plan 模式下对计划文件的写入，
 
 ### YOLO / Auto 模式
 
-**YOLO 模式**（`/yolo`）自动批准普通工具调用，适合已知安全的批处理任务。敏感操作仍会询问——例如访问 `.env`、SSH 私钥等敏感文件，或退出 Plan 模式——Agent 也仍可能向你提问。
+**YOLO 模式**（`/yolo`）自动批准普通工具调用，适合已知安全的批处理任务。敏感操作仍会询问——例如访问 `.env`、SSH 私钥等敏感文件、执行 `shutdown`、`rm -rf` 这类危险命令，或退出 Plan 模式——Agent 也仍可能向你提问。
 
-**Auto 模式**（`/auto`）是完全无人值守模式：所有工具审批自动处理，包括敏感文件和计划退出，且 Agent 不会向你提问，完全由它自己做决定。
+**Auto 模式**（`/auto`）是完全无人值守模式：所有工具审批自动处理，包括敏感文件和计划退出，且 Agent 不会向你提问，完全由它自己做决定。唯一的例外是内置的危险命令拦截：`shutdown`、`reboot`、`rm -rf` 这类命令在 Auto 模式下会被直接拒绝，在 Manual 和 YOLO 模式下必须经你确认。
 
 
 ## 模式切换

packages/acp-adapter/src/modes.ts

@@ -39,7 +39,7 @@ export const ACP_MODES = [
   {
     id: 'auto',
     name: 'Auto',
-    description: 'Fully autonomous — agent decides everything without asking.',
+    description: 'Fully autonomous, but dangerous commands are blocked.',
   },
   {
     id: 'yolo',

packages/agent-core-v2/docs/config-manifest.toml

@@ -278,7 +278,9 @@ merge_all_available_skills = true
 # permission
 #   owner: src/agent/permissionRules/configSection.ts
 #   scope: core
-#   hooks: custom fromToml · custom toToml
+#   hooks: custom fromToml · custom toToml · stripEnv
+#   env:
+#     dangerous_command_guard <- KIMI_CODE_DANGEROUS_COMMAND_GUARD (custom parse)
 # ##########################################################################
 
 [permission]
@@ -287,6 +289,7 @@ merge_all_available_skills = true
   # scope: "turn-override" | "session-runtime" | "project" | "user" (default: "user")
   # pattern: string
   # reason: string
+# dangerous_command_guard: boolean
 
 # ##########################################################################
 # providers

packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts

@@ -1,8 +1,10 @@
 import { IInstantiationService } from "#/_base/di/instantiation";
 import { Service } from "#/_base/di/service";
+import { IBootstrapService } from '#/app/bootstrap/bootstrap';
 import type { ResolvedToolExecutionHookContext } from '#/agent/toolExecutor/toolHooks';
 import { AutoModeApprovePermissionPolicyService } from '#/agent/permissionPolicy/policies/auto-mode-approve';
 import { AutoModeAskUserQuestionDenyPermissionPolicyService } from '#/agent/permissionPolicy/policies/auto-mode-ask-user-question-deny';
+import { DangerousCommandAskPermissionPolicyService } from '#/agent/permissionPolicy/policies/dangerous-command-ask';
 import { DefaultToolApprovePermissionPolicyService } from '#/agent/permissionPolicy/policies/default-tool-approve';
 import { FallbackAskPermissionPolicyService } from '#/agent/permissionPolicy/policies/fallback-ask';
 import { GitControlPathAccessAskPermissionPolicyService } from '#/agent/permissionPolicy/policies/git-control-path-access-ask';
@@ -31,11 +33,15 @@ export class AgentPermissionPolicyService
 
   constructor(
     @IInstantiationService private readonly instantiation: IInstantiationService,
+    @IBootstrapService bootstrap: IBootstrapService,
   ) {
     super();
     this.policies = [
       this.instantiation.createInstance(AutoModeAskUserQuestionDenyPermissionPolicyService),
       this.instantiation.createInstance(UserConfiguredDenyPermissionPolicyService),
+      ...(bootstrap.args.nonInteractive
+        ? []
+        : [this.instantiation.createInstance(DangerousCommandAskPermissionPolicyService)]),
       this.instantiation.createInstance(AutoModeApprovePermissionPolicyService),
       this.instantiation.createInstance(SessionApprovalHistoryPermissionPolicyService),
       this.instantiation.createInstance(UserConfiguredAskPermissionPolicyService),