PR #60507: feat(security): add destructive-commands.ts — catalog of HIL-required exec patterns for agentic workloads

• Repository: openclaw/openclaw
• Author: bryanbaer
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/60507

Description (problem / solution / changelog)

Summary

Adds src/security/destructive-commands.ts — a curated catalog of command patterns that should require Human-in-the-Loop (HIL) approval when running in agentic contexts.

Motivation

When autonomous agents run in agentic workflows (sub-agent spawning, background cron jobs, multi-step orchestration), they can inadvertently execute destructive commands like kubectl delete, terraform destroy, or rm -rf without the user realizing it's happening.

OpenClaw already has an excellent exec approval system (ask=on-miss, security=allowlist). This PR adds a canonical reference catalog of patterns that should not be on any default allowlist.

What's in the catalog

Patterns organized by tool category, each with a comment explaining rationale:

• Kubernetes: kubectl delete, kubectl drain, kubectl apply (state changes), scale, rollout restart/undo
• Terraform: terraform apply, terraform destroy, taint, import, state mutations
• GCP gcloud: create, delete, update, set, deploy, disable/enable operations
• Filesystem: rm, rmdir, shred, dd, truncate
• Git: push --force, push to main/master/production, reset --hard, filter-branch
• Database: DROP, TRUNCATE, DELETE, ALTER via psql/mysql/sqlite3
• Process: kill -9, killall, pkill -9
• SSH: remote destructive sudo commands

Design — safe operations explicitly excluded

• kubectl get/describe/logs/rollout status → NOT in the list (read-only)
• terraform plan/init/validate → NOT in the list (read-only)
• gcloud * list/describe/get → NOT in the list (read-only)
• Normal git push → NOT in the list (only force variants)

Usage with existing approval system

import { ALL_DESTRUCTIVE_PATTERNS } from './security/destructive-commands.js';

// Example: in exec approval policy initialization
const requiresHIL = ALL_DESTRUCTIVE_PATTERNS.some(pattern =>
  matchAllowlist(command, [{ pattern }])
);

With security=allowlist + ask=on-miss in exec-approvals.json, any command not on the safe allowlist automatically triggers the approval flow — including anything matching these patterns.

Tests

src/security/destructive-commands.test.ts covers:

• Safe kubectl/terraform operations are NOT matched
• Destructive operations ARE matched
• No duplicates in the full pattern set

Related

Companion to issue #60497 (agent fabricates success after exec failure). Requiring approval before destructive commands run is the proactive complement to fail-closed exec behavior after the fact.

Also complements:

• dangerous-tools.ts (tool-level deny list)
• exec-safe-bin-policy.ts (safe binary allowlist)

Contributed by a user running BMAD agentic orchestration on a 200-core bare-metal Hive cluster. We hit these failure modes the hard way and built these patterns from production incidents.

Changed files

• src/security/destructive-commands.test.ts (added, +76/-0)
• src/security/destructive-commands.ts (added, +172/-0)