Destructive Command Guard 备份工具防护包Backup Packs解析Borg、Rclone、Restic 与 Velero 危险命令拦截机制【免费下载链接】destructive_command_guardThe Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.项目地址: https://gitcode.com/GitHub_Trending/de/destructive_command_guard本文基于 Destructive Command Guarddcg官方包参考文档 docs/packs/backup.md 展开系统讲解backup类别下 4 个防护包BorgBackup、Rclone、Restic、Velero的规则设计、正则匹配边界、严重级别分级与放行/拦截策略并结合仓库源码src/packs/backup/与测试用例说明如何理解、启用、验证与按需放行这些备份工具的危险命令防护规则。读完本文你将掌握 dcg 备份类防护包的完整规则清单、allowlist 配置方法以及如何用测试与场景夹具验证拦截行为。一、Backup 类别概览为什么备份工具需要独立防护包备份工具的核心职责是复制与保留但几乎所有主流备份 CLI 都内置了删除、清理、压缩、去重等破坏性子命令。当 AI 编码代理Agent在用户环境中执行命令时一条rclone sync或restic prune就可能永久删除远端数据或使备份仓库不可恢复。dcg 的backup类别正是针对这类备份链路上的危险操作提供专项防护。从 docs/packs/README.md 的分类表可见backup类别共包含 4 个 PackPack ID工具防护重点backup.borgBorgBackupdelete、prune、compact、recreate、break-lockbackup.rcloneRclonesync、delete、purge、dedupe、move 等backup.resticResticforget、prune、key remove、unlock、cache cleanupbackup.veleroVelerobackup/schedule/restore/location 删除与 uninstall模块组织上四个 Pack 分别对应 src/packs/backup/borg.rs、src/packs/backup/rclone.rs、src/packs/backup/restic.rs、src/packs/backup/velero.rs并由 src/packs/backup/mod.rs 统一挂载到 Pack 注册系统。启用整个类别只需在配置中写入类别前缀backup[packs] enabled [backup] # 展开为 backup.borg / backup.rclone / backup.restic / backup.velero按照 src/packs/mod.rs 的说明Pack 采用类别Category→ 子包Sub-pack两级层次结构启用类别会启用其下全部子包也可以单独禁用某个子包详见 docs/configuration.md[packs] enabled [ backup, # 类别 ID启用全部 backup.* 子包 kubernetes, ] disabled [ # backup.rclone, # 可选类别保持启用但剔除单个子包 ]除配置文件外也可通过环境变量覆盖例如DCG_PACKSbackup,kubernetes、DCG_DISABLEbackup.restic。二、匹配机制基础Keyword 触发、Safe Pattern 放行、Destructive Pattern 拦截每个 Pack 都包含三类要素Keywords命令文本中出现该关键字时命令才会进入此 Pack 的规则检查。四个备份 Pack 的关键字分别是borg、rclone、restic、velero。Safe Patterns安全模式匹配到即始终放行的命令形态如查看、校验、创建、恢复等只读或非破坏性操作。Destructive Patterns破坏模式匹配到即按严重级别拦截/告警的命令形态并附带拦截原因reason与严重级别severity。在源码中模式通过safe_pattern!与destructive_pattern!两个宏声明定义见 src/packs/mod.rs。宏内部使用LazyCompiledRegex包装正则首次使用时才编译避免拖慢启动与热路径destructive_pattern!支持命名、指定严重级别、附带解释文本explanation并为后续版本保留了executables [...]作用域子句issue #289 引入可将规则限定到特定 argv0 解析结果。四个备份 Pack 均设置safe_regex_set: None与keyword_matcher: None即没有引入额外的 DFA 预筛或关键字匹配器优化规则执行路径为标准正则匹配关于正则后端可参考 docs/regex-automata-decision-memo.md 与 src/packs/regex_engine.rs。三、BorgBackup 防护包backup.borgPack IDbackup.borg关键字borg。防护目标是 borg 的删除、修剪、压缩、重建与强制解锁等破坏性归档操作。3.1 安全模式放行以下模式匹配安全命令始终放行Pattern NamePatternborg-listborg(?:\s--?\S(?:\s\S)?)*\slist(?\s\|$)borg-infoborg(?:\s--?\S(?:\s\S)?)*\sinfo(?\s\|$)borg-diffborg(?:\s--?\S(?:\s\S)?)*\sdiff(?\s\|$)borg-checkborg(?:\s--?\S(?:\s\S)?)*\scheck(?\s\|$)borg-createborg(?:\s--?\S(?:\s\S)?)*\screate(?\s\|$)borg-extractborg(?:\s--?\S(?:\s\S)?)*\sextract(?\s\|$)borg-mountborg(?:\s--?\S(?:\s\S)?)*\smount(?\s\|$)以borg list、borg info repo::archive、borg create repo::archive /srv/app、borg extract repo::archive、borg mount repo::archive /mnt/backup为代表的查看/创建/提取/挂载操作全部放行。测试覆盖见 src/packs/backup/borg.rs 中的allows_safe_commands与borg_all_safe_patterns_match。3.2 破坏性模式拦截Pattern NameReasonSeverityborg-deleteborg delete removes archives or entire repositories.criticalborg-pruneborg prune removes archives based on retention rules.highborg-compactborg compact reclaims space after deletions.mediumborg-recreateborg recreate can drop data from archives.highborg-break-lockborg break-lock forces removal of repository locks.medium结合 src/packs/backup/borg.rs 中每个模式附带的 explanation可以更深入理解拦截理由与替代方案borg-deletecritical删除归档或整个仓库会永久移除备份数据丢失后无法恢复到该时间点删除整个仓库则全部备份历史不可恢复。建议先用borg list复查、borg info查看归档详情、borg export-tar导出内容或用--dry-run预览删除对象。borg-prunehigh按保留规则移除归档保留策略配置错误可能删除超出预期的归档且 prune 后空间要等borg compact才会真正回收。建议先用borg prune --dry-run预览并核对--keep-daily、--keep-weekly等保留参数。borg-compactmedium回收 delete/prune 之后不再被引用的数据段。compact 之前被删数据理论上仍可恢复compact 之后则彻底消失。建议 compact 前用borg list确认归档仍在、用borg check验证仓库完整性。borg-recreatehighrecreate 会通过重新压缩或排除文件修改既有归档配合--exclude/--exclude-from会永久移除归档中的文件且完成后无法恢复原状态。建议先borg recreate --dry-run预览或改用borg create新建归档。borg-break-lockmedium强制移除仓库锁。若确有其他 borg 进程在运行而非陈旧锁强行破锁可能导致仓库损坏。建议先用ps aux | grep borg确认没有活动进程、核实锁文件时间戳确为陈旧锁。3.3 正则边界设计防止子串误放行安全模式统一以(?\s|$)作为子命令后缀边界见 src/packs/backup/borg.rs 顶部注释归档名若包含子命令关键字子串如归档名list-archives、info-backup不会因为命中borg-list等安全规则而短路short-circuit掉对破坏性 borg 命令的拦截。这是 Pack 正则设计中最值得注意的细节安全规则的匹配必须精确到子命令词边界否则borg delete repo::list-archives这类命令可能被误判为安全操作。四、Rclone 防护包backup.rclonePack IDbackup.rclone关键字rclone。防护重点是 sync单向同步会删除目标端多余文件、delete/purge 以及 dedupe、move 等会改变或删除远端数据的操作。4.1 安全模式放行Pattern NamePatternrclone-copyrclone(?:\s--?\S(?:\s\S)?)*\scopy(?\s\|$)rclone-lsrclone(?:\s--?\S(?:\s\S)?)*\sls(?\s\|$)rclone-lsdrclone(?:\s--?\S(?:\s\S)?)*\slsd(?\s\|$)rclone-lslrclone(?:\s--?\S(?:\s\S)?)*\slsl(?\s\|$)rclone-sizerclone(?:\s--?\S(?:\s\S)?)*\ssize(?\s\|$)rclone-checkrclone(?:\s--?\S(?:\s\S)?)*\scheck(?\s\|$)rclone-configrclone(?:\s--?\S(?:\s\S)?)*\sconfig(?\s\|$)rclone-dry-run\brclone\b(?:\s\S)*\s(?:--dry-run(?:true)?\|-n)(?:\s\|$)注意rclone-copy与rclone-sync的区别copy只做单向复制、不删除目标端文件因此放行sync则会使目标端与源完全一致删除多余文件因此被拦截。这也是源码 explanation 中反复建议考虑用rclone copy替代非破坏性传输的原因。4.2 破坏性模式拦截Pattern NameReasonSeverityrclone-syncrclone sync deletes destination files not present in the source.criticalrclone-deleterclone delete removes files and directories from the target.criticalrclone-deletefilerclone deletefile removes a single file from the target.highrclone-purgerclone purge deletes a path and all its contents.criticalrclone-cleanuprclone cleanup removes old/malformed uploads.mediumrclone-deduperclone dedupe can delete or rename duplicate files.highrclone-moverclone move deletes source files after copying.high结合 src/packs/backup/rclone.rs 的 explanationrclone-synccritical目标端存在而源端不存在的文件会被删除属单向同步source → destination。建议先--dry-run预览或改用rclone copy。rclone-deletecritical按路径/过滤器删除远端文件不删目录删目录用 purge--include/--exclude过滤器会影响被删对象。建议rclone delete remote:path --dry-run预览。rclone-deletefilehigh精确删除单个指定文件比 bulk delete 更聚焦但同样不可撤销。rclone-purgecritical删除指定路径及其下所有文件与子目录比 delete 更彻底。建议先rclone ls remote:path列出内容。rclone-cleanupmedium清理旧/未完成的分片上传与失败传输残留可能中断进行中的上传一般安全但需先检查是否有活动上传。rclone-dedupehigh可删除重复文件--dedupe-mode oldest/newest或重命名重复项交互模式可逐文件选择。建议rclone dedupe remote:path --dry-run预览。rclone-movehigh复制到目标端后删除源文件。建议先--dry-run或用rclone copy保留源。4.3 dry-run 放行的防绕过设计rclone-dry-run安全模式允许--dry-run或--dry-runtrue、-n出现在命令中从而放行预览型的 sync/delete 等命令。但 src/packs/backup/rclone.rs 的测试rclone_false_dry_run_does_not_bypass_destructive_patterns专门验证了绕过场景for (command, pattern) in [ (rclone sync src: dest: --dry-runfalse, rclone-sync), (rclone delete remote:path --dry-runfalse, rclone-delete), (rclone purge remote:path --dry-runfalse, rclone-purge), (rclone move src: dest: --dry-runfalse, rclone-move), (rclone dedupe remote:path --dry-runfalse, rclone-dedupe), (rclone sync src: dest: --dry-run0, rclone-sync), (rclone sync src: dest: --no-dry-run, rclone-sync), ] { assert_blocks_with_pattern(pack, command, pattern); assert_no_safe_match(pack, command); }即--dry-runfalse、--dry-run0、--no-dry-run这类伪 dry-run写法不会被rclone-dry-run安全规则放行仍会命中对应的破坏性规则而被拦截。五、Restic 防护包backup.resticPack IDbackup.restic关键字restic。防护重点是快照遗忘forget、数据修剪prune、密钥删除、强制解锁与缓存清理。5.1 安全模式放行Pattern NamePatternrestic-snapshotsrestic(?:\s--?\S(?:\s\S)?)*\ssnapshots(?\s\|$)restic-lsrestic(?:\s--?\S(?:\s\S)?)*\sls(?\s\|$)restic-statsrestic(?:\s--?\S(?:\s\S)?)*\sstats(?\s\|$)restic-checkrestic(?:\s--?\S(?:\s\S)?)*\scheck(?\s\|$)restic-diffrestic(?:\s--?\S(?:\s\S)?)*\sdiff(?\s\|$)restic-findrestic(?:\s--?\S(?:\s\S)?)*\sfind(?\s\|$)restic-backuprestic(?:\s--?\S(?:\s\S)?)*\sbackup(?\s\|$)restic-restorerestic(?:\s--?\S(?:\s\S)?)*\srestore(?\s\|$)覆盖快照列举、文件列举、统计、完整性检查、差异比较、查找、备份与恢复等安全操作。测试覆盖见 src/packs/backup/restic.rs 的allows_safe_commands。5.2 破坏性模式拦截Pattern NameReasonSeverityrestic-forgetrestic forget removes snapshots and can permanently delete backup data.criticalrestic-prunerestic prune removes unreferenced data and is irreversible.criticalrestic-key-removerestic key remove deletes encryption keys and can make backups unrecoverable.criticalrestic-unlock-remove-allrestic unlock --remove-all force-removes repository locks.highrestic-cache-cleanuprestic cache --cleanup removes cached data from disk.low注意 restic 的破坏性规则使用了更宽松的restic\b.*\s...形态而非安全规则的(?\s|$)词边界形式以便匹配 forget 与--keep-last/--prune等参数组合的多种写法。结合 src/packs/backup/restic.rsrestic-forgetcritical从仓库移除快照元数据数据本身要等 prune 才真正删除。建议用--keep-*保留近期快照先restic forget --dry-run预览。restic-prunecritical永久删除不再被快照引用的数据不可撤销大仓库可能耗时很长。通常与 forget 搭配也可用restic forget --prune合并执行。restic-key-removecritical删除仓库加密密钥。若所有密钥被删仓库将完全无法访问、数据不可恢复。务必至少保留一个可用密钥删除前用restic key list查看。restic-unlock-remove-allhigh强制移除全部锁。若其他 restic 进程正在运行可能导致仓库损坏仅应在锁陈旧/孤儿时使用。restic-cache-cleanuplow仅清理本地缓存不影响仓库数据下次操作会重建缓存属于低风险操作默认仅记录日志。六、Velero 防护包backup.veleroPack IDbackup.velero关键字velero。防护重点是 Kubernetes 备份/恢复/调度及存储位置相关对象的删除操作与整体卸载。6.1 安全模式放行Pattern NamePatternvelero-backup-getvelero(?:\s--?\S(?:\s\S)?)*\sbackup\sget(?\s\|$)velero-backup-describevelero(?:\s--?\S(?:\s\S)?)*\sbackup\sdescribe(?\s\|$)velero-backup-logsvelero(?:\s--?\S(?:\s\S)?)*\sbackup\slogs(?\s\|$)velero-backup-createvelero(?:\s--?\S(?:\s\S)?)*\sbackup\screate(?\s\|$)velero-schedule-getvelero(?:\s--?\S(?:\s\S)?)*\sschedule\sget(?\s\|$)velero-restore-createvelero(?:\s--?\S(?:\s\S)?)*\srestore\screate(?\s\|$)velero-versionvelero(?:\s--?\S(?:\s\S)?)*\sversion(?\s\|$)与其他 Pack 不同Velero 的子命令由两级词组成如backup get、backup describe因此安全模式用\sbackup\sget(?\s|$)形式精确匹配子命令对。测试覆盖见 src/packs/backup/velero.rs 的allows_safe_commands。6.2 破坏性模式拦截Pattern NameReasonSeverityvelero-backup-deletevelero backup delete removes a backup and its data.highvelero-schedule-deletevelero schedule delete removes scheduled backups.mediumvelero-restore-deletevelero restore delete removes restore records.lowvelero-backup-location-deletevelero backup-location delete removes a backup storage location.highvelero-snapshot-location-deletevelero snapshot-location delete removes a snapshot location.highvelero-uninstallvelero uninstall removes the Velero deployment and related resources.critical结合 src/packs/backup/velero.rs 的 explanationvelero-backup-deletehigh同时移除 Kubernetes 中的备份元数据与对象存储中的实际备份数据删除后无法恢复到该备份点不可逆。建议先velero backup describe复查、用 TTL 策略替代手工删除。velero-schedule-deletemedium停止定时备份的自动创建已创建的备份不受影响但若遗忘会导致备份陈旧、恢复缺口。临时停用建议先velero schedule get/describe复查。velero-restore-deletelow仅移除恢复操作的元数据记录不影响已恢复的资源与原备份但会丢失审计轨迹。velero-backup-location-deletehigh断开 Velero 与该存储后端的连接存储中的备份数据仍在但 Velero 无法访问直到重建 location 才能恢复。删除前应复查velero backup-location get并确认没有关键备份依赖该位置。velero-snapshot-location-deletehigh移除卷快照位置配置既有快照可能变成孤儿、依赖该位置的卷恢复将失败。删除前复查velero snapshot-location get。velero-uninstallcritical移除部署、CRD 及全部 Velero 管理资源调度立即停止对象存储中的备份数据虽保留但必须重装并重新配置 Velero 才能恢复。卸载前建议记录当前配置、导出资源清单如kubectl get -o yaml。七、Allowlist 配置按规则或按 Pack 放行原文档为每个 Pack 提供了统一的放行配置模板。若确需放行某个具体规则在 allowlist 中按pack-id:pattern-name引用[[allow]] rule backup.borg:borg-prune reason Weekly retention prune is approved by ops runbook如需放行某个 Pack 的全部规则谨慎使用使用通配符并要求显式承认风险[[allow]] rule backup.rclone:* reason Team policy allows controlled rclone sync for this repo risk_acknowledged true四个 Pack 的规则命名空间分别为backup.borg:pattern-name、backup.rclone:pattern-name、backup.restic:pattern-name、backup.velero:pattern-name。需要说明的是并非所有规则都可以被宽松策略覆盖。根据 src/packs/mod.rs 中Severity的定义critical级别始终拦截Always block、high级别默认拦截但可按规则 ID 放行allowlistable、medium级别默认告警warn 继续执行、low级别仅记录日志log。因此backup.borg:borg-delete、backup.rclone:rclone-sync、backup.restic:restic-forget、backup.velero:velero-uninstall这类 critical 规则属于不可逆、高置信度检测默认必然拦截而borg-compact、rclone-cleanup、restic-cache-cleanup、velero-restore-delete等 medium/low 规则默认只告警或记录行为更温和。严重级别到默认决策模式的映射在 src/packs/mod.rs 的Severity::default_mode()中定义Critical | High → Deny拦截、Medium → Warn告警、Low → Log仅记录。若需覆盖默认策略可在[policy]中按 Pack 或按规则调整[policy] default_mode ask [policy.packs] backup.restic deny [policy.rules] backup.rclone:rclone-cleanup warnallowlist 文件按项目 → 用户 → 系统分层生效默认写入用户层~/.config/dcg/allowlist.toml具体说明见 docs/configuration.md 的 Allowlists 章节。八、实战验证从场景夹具到回归测试dcg 仓库提供了多种验证途径帮助你确认备份类规则的拦截行为1. 场景级端到端夹具tests/fixtures/scenarios/backup_rotation.yaml 模拟rclone rsync 备份轮转真实工作流逐条断言命令的预期 Pack 与决策id: backup.rotation.rclone_rsync description: Rotate backups with rclone sync and rsync staging. steps: - command: rclone ls remote:bucket expected_pack: backup.rclone expected_decision: allow reason: List backup contents - command: rclone sync /data remote:bucket --dry-run expected_pack: backup.rclone expected_decision: allow reason: Dry-run sync preview - command: rclone sync /data remote:bucket --delete-excluded expected_pack: backup.rclone expected_decision: deny reason: Sync with delete-excluded removes destination objects - command: rclone cleanup remote:bucket expected_pack: backup.rclone expected_decision: deny reason: Cleanup deletes old or unneeded objects该夹具验证了核心行为ls/copy/check与带--dry-run的 sync 放行而--delete-excluded的 sync 与cleanup被拦截。2. 单元级回归测试每个 Pack 源码内嵌#[cfg(test)]测试模块例如 src/packs/backup/rclone.rs 中的blocks_destructive_commands、rclone_blocks_with_correct_severity、rclone_false_dry_run_does_not_bypass_destructive_patterns以及 src/packs/backup/borg.rs 中的borg_blocks_with_correct_severity。运行方式cargo test --lib packs::backup3. 模式审计测试tests/pattern_audit.rs 会引用backup.*规则做跨包一致性检查如规则名唯一、reason 完备、正则可编译。此外 tests/fixtures/safe_commands.yaml 与 tests/fixtures/destructive_commands.yaml 也收录了备份工具的放行/拦截样例。4. 命令行快速验证启用 backup 类别后可直接用 dcg 测试单条命令robot 模式输出 JSON便于脚本断言dcg --robot test --format json restic forget latest dcg --robot test --format json rclone sync /data remote:bucket --dry-run九、总结与最佳实践围绕 docs/packs/backup.md 与 src/packs/backup/ 源码可以提炼出以下要点备份类危险命令覆盖面广backup类别覆盖 Borg、Rclone、Restic、Velero 四类主流工具共 26 个安全模式与 23 个破坏性模式覆盖删除、修剪、压缩、去重、移动、密钥删除、强制解锁与整体卸载等场景。安全/破坏双轨制查看、校验、创建、恢复类命令由 Safe Pattern 放行删除、同步等命令由 Destructive Pattern 按严重级别处理。安全模式统一使用(?\s|$)词边界防止归档名/路径名中的子串误放行破坏性命令。严重级别决定默认行为critical 始终拦截且不可被宽松策略覆盖high 默认拦截但可 allowlistmedium 默认告警low 默认仅记录。在 [policy] 中可按 Pack 或按规则精细调整。防绕过设计经过专门测试Rclone 的 dry-run 伪参数--dry-runfalse、-n变体之外的反例会被明确拦截相关回归测试写入源码测试模块。验证手段丰富既有场景级 YAML 夹具backup_rotation.yaml又有源码内单元测试与 pattern_audit 审计可在 CI 中持续保障规则正确性。在实际使用中建议按默认全开 按需 allowlist的方式部署启用整个backup类别以保护所有备份链路仅在经过评估后对确有业务诉求的规则如受控的borg-prune以pack-id:pattern-name形式精确放行并为每次放行填写可审计的 reason。【免费下载链接】destructive_command_guardThe Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.项目地址: https://gitcode.com/GitHub_Trending/de/destructive_command_guard创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考