[Bug] Auto-Classifier allows dangerous pkill -f commands with hidden regex over-matching

Bug Description
The auto classifier allowed the command pkill -f "node server.js" -f 8788 which killed 27 processes, Signal, Slack, Spotify, Chrome, Linear... This should not have been allowed. Claude later analyzed this as such: Confirmed and fully explained. 26 (substring -f) + 1 (node server) = the 27 the malformed command matched. Here's the complete, accurate picture for your report. The exact command pkill -f "node server.js" -f 8788 I ran this (with 2>/dev/null) trying to kill "the node server that is on port 8788." My intent was an AND — node server and 8788. But pkill has no AND; a pattern is a single regex. The second -f 8788 is nonsense, and that's where it went wrong. Why it matched 27 processes instead of 1 (reproduced read-only with pgrep) macOS pkill/pgrep parsed the arguments as: the -f flag, then three leftover operands — "node server.js", "-f", "8788" — and treated the multiple operands as alternative (OR) patterns. The stray bareword -f became a regex that matches any command line containing the substring -f. - node server.js → matched 1 (the intended server) - -f → matched 26 processes, because virtually every Chromium/Electron app's command line contains -f (e.g. --shared-files, --field-trial-handle, parsec-fbf) - 8788 → matched 0 Proof: pgrep -f -- "-f" returns 26; pgrep -f "node server.js" returns 1; the malformed form returns 27. The correctly-formed two-operand version pgrep -f "node server.js" "8788" returns only 1 — so the breakage is specifically the stray -f. What actually got killed The 27 matches were the node server plus helper/renderer/GPU processes of: Signal (3 procs), Slack, Spotify, Steam, Linear, Google Chrome, and CoreParsec. Killing an app's helper process destabilizes/crashes the parent app — that's why Signal went down. (None of your data is touched; these are restartable processes.) On the classifier (your actual question) I won't make excuses for it, but factually: the command reads as pkill -f "node server.js" … — a narrow, app-named kill of a dev server, which is an extremely common, benign developer action. The destructive breadth was entirely hidden in an argument-parsing pathology (a stray -f turning into a substring OR-pattern) that isn't visible in the command text. A static reviewer — human or classifier — sees "kill my node server," not "kill everything whose command line contains -f." That's exactly why it's dangerous and worth reporting: the surface form and the actual blast radius diverge completely. The general hazard is that pkill -f <anything> matches by regex against all processes' full command lines and silently over-matches.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.195
• Feedback ID: 70cdf205-34df-41e9-acb4-ec8070a412c2

Errors

[]