I haven't used relayd in about 8 years, but something like:
Code:
block url "/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>" label "URL blocked"
block url "/?XDEBUG_SESSION_START=phpstorm" label "URL blocked"
might possibly work. Have you been through the FILTER RULES section of the relayd.conf(5) man page?