destructive-hook-regex-matches-rm-inside-echo-strings

Hook regex patterns like \b(rm|mv)\s+.FILE match the substring rm or mv anywhere in a command string, including inside echo ‘rm FILE’ quoted literals and documentation strings, causing false-positive blocks on harmless read/echo commands. Fix: anchor with CMD_START = r’(?:^|[;&|`(]\s)’ so rm/mv must appear at the actual start of a shell command token, not inside a quoted string argument.

Related

• destructive-ops-blocker-false-positive-on-backup-suffixes
• destructive-hook-regex-word-boundary-backup-false-positive
• docker
• salesforce
• spec-reviewer-blocks-on-os-system-in-test-code
• hook-regex-false-positives-require-cmd-start-not-backup-anch
• hook-regex-cmd-start-not-backup-anchors-required
• hook-regex-false-positives-cmd-start-not-backup-anchors
• security-reminder-hook-blocks-literal-exec-eval-in-prose
• security-hook-blocks-literal-exec-eval-tokens-in-prose
• security-hook-blocks-literal-exec-eval-in-prose