hook-regex-cmd-start-not-backup-anchors-required

Destructive-ops-blocker hooks using bare word-boundary regex (\b) have two structural false-positive flaws: (1) \b matches backup filenames like MEMORY.md.bak.123 because dot is a non-word character, and (2) pattern matches ‘rm’ anywhere in command string including echo literals. Fix requires CMD_START anchor (^|[;&|`(]\s*) and NOT_BACKUP lookahead (?![.\w]) on every Critical Path pattern. Added 12-case test suite to hook to prevent regression.

Related

• hook-regex-false-positives-require-cmd-start-not-backup-anch
• destructive-ops-blocker-false-positive-on-backup-suffixes
• hook-regex-needs-cmdstart-and-notbackup-anchors-to-prevent-f
• destructive-hook-regex-word-boundary-backup-false-positive
• destructive-hook-regex-matches-rm-inside-echo-strings
• hook-regex-word-boundary-false-positives-on-backups
• hook-regex-false-positives-cmd-start-not-backup-anchors
• pine-script-trailing-stop-requires-ratchet-pattern
• pine-script-request-security-nonrepainting-params
• session-close-phase-1-6-disposition-is-not-resolution
• security-hook-blocks-exec-eval-tokens-in-prose
• security-hook-blocks-literal-exec-eval-in-prose
• makefile-awk-help-regex-excludes-digit-targets