fix(approval): tighten 'delete in root path' regex to system roots only

[williams145]

Problem

tools/approval.py:215 defines DANGEROUS_PATTERNS[0] as:

(r'\brm\s+(-[^\s]*\s+)*/', "delete in root path"),

Because / only requires a single forward-slash to match, every absolute-path rm is flagged "delete in root path" — including routine cleanups in the user's home, /tmp, /mnt, etc.

Real example from the issue report:

rm -f /home/scott/hermes-home/fawn_lily_temp.html
↳ Reason: delete in root path

That command deletes one file in the user's home directory — nowhere near the system root.

Fix

Replace the over-broad pattern with one that only fires on actual system-root targets:

(
    r'\brm\s+(-[^\s]*\s+)*/(\s|\*|$|\.\*|'
    r'(bin|boot|dev|etc|lib|lib64|opt|proc|root|run|sbin|srv|sys|usr|var)(/|\s|$))',
    "delete in root path",
),

This matches:

• bare /, root globs /*, /.*
• system top-level directories (/bin, /boot, /dev, /etc, /lib, /lib64, /opt, /proc, /root, /run, /sbin, /srv, /sys, /usr, /var) followed by /, whitespace, or end of string

The boundary requirement prevents false matches on look-alike paths (/etc.bak/..., /var-something/..., /opting/...).

Verification

Command	Before	After
rm -rf /	flagged	flagged
rm -rf /*	flagged	flagged
rm -rf /.*	flagged	flagged
rm -rf /etc/passwd	flagged	flagged
rm -rf /var/log	flagged	flagged
rm /usr/bin/something	flagged	flagged
rm /home/user/foo	flagged (false +)	not flagged
rm -f /home/scott/hermes-home/x.html	flagged (false +)	not flagged
rm /tmp/x	flagged (false +)	not flagged
rm -rf /mnt/c/Users/u/foo	flagged (false +)	not flagged
rm -rf /home/user/.cache	flagged (false +)	not flagged
rm /etc.bak/file (look-alike)	flagged (false +)	not flagged

Recursive deletes on user paths (e.g. rm -rf /home/user) continue to be flagged correctly via the separate "recursive delete" pattern — they just lose the misleading "root path" label.

Tests

New TestRmAbsolutePathNotFalseFlagged class in tests/tools/test_approval.py covers:

• The exact real-world false positive from the issue
• /tmp, /mnt/c/... user-space paths
• /etc.bak look-alike path
• /, /*, /.*, /etc/passwd, /var/log, /usr/bin/..., /etc, /lib64/... still flagged

Existing TestDetectDangerousRm and TestRmRecursiveFlagVariants continue to pass — recursive-flag commands fall through to the "recursive delete" pattern, which still satisfies their "delete" in desc.lower() assertions. Full suite: 145 passed.

Fixes #18083

---

Note: same author has two other open PRs ready for review — #12584 (fixes #6133) and #12592 (fixes #5861). Both apply cleanly to current main.

[alt-glitch]

Related to #18089 (same fix, different author) and #18083 (issue report). Likely duplicate of #18089.

[williams145]

Thanks @alt-glitch — confirmed, closing in favor of #18089 by @briandevans. His version is more thorough (adds the legacy-key alias table and the divergence comment). Will redirect attention to the other two open PRs (#12584, #12592) which address different issues.