[ROSETTA] dangerous-actions git-branch-delete pattern misses force-delete flag variants

[isolomatov-gd]

The `git-branch-delete` pattern in `src/hooks/src/hooks/dangerous-actions/patterns.ts` (line 110) is `/\bgit\s+branch\s+-D\b/` — it only matches the literal uppercase combined flag `-D`. It misses equivalent force-delete forms like `git branch -d -f`, `git branch -fd`, and `git branch --delete --force`, all of which force-delete an unmerged branch just like `-D`.

Other destructive-pattern entries in the same file (`rm -rf`, `git push --force`) deliberately use permutation-tolerant matching for flag reordering/combination, but this one doesn't follow that convention. `src/hooks/tests/dangerous-actions.test.ts` (~lines 785-804) only tests the literal `-D` form. Where: `src/hooks/src/hooks/dangerous-actions/patterns.ts`.

[github-actions]

Rosetta Triage

Classification: bug, good first issue — regex gap in an existing guardrail pattern, not new instruction authoring
Priority assessment: Medium — git-branch-delete is a reconsider-policy dangerous-action guardrail (src/hooks/src/hooks/dangerous-actions/patterns.ts:110); missing variants let an unmerged branch force-delete slip past HITL review silently, but impact is bounded (branch delete is reflog-recoverable, unlike rm -rf).

Findings:

• Confirmed: re: /\bgit\s+branch\s+-D\b/ only matches literal -D, verified against the current file.
• Confirmed gap: git branch -d -f, git branch -fd, git branch --delete --force all force-delete but don't match.
• Confirmed inconsistency: neighboring entries (rm-rf-recursive, git-clean-force via -[a-z]*[fd], git-force-push via lookahead helpers) already tolerate flag reordering/combination/long-form; git-branch-delete doesn't follow suit.
• Confirmed test gap: src/hooks/tests/dangerous-actions.test.ts (~785-804) only exercises literal -D and its # Rosetta-AI-reviewed-override counterpart — no case for -fd, -d -f, or --delete --force.

Suggestions:

• Rework the pattern to detect force-delete regardless of flag form/order, e.g. requiring -d/--delete co-occurring with -f/--force in either order or combined short flags (-Dd/-fd/-df), alongside the existing plain -D match — mirroring the combined-flag handling already used for git-clean-force.
• Add regression tests for -d -f, -fd, -df, and --delete --force (both blocking and the # Rosetta-AI-reviewed override case) next to the existing ~785-804 block.
• Re-run venv/bin/python scripts/pre_commit.py after the hook change (rebuilds hook bundles + regenerates plugins) per docs/ARCHITECTURE.md.

Automated triage by Rosetta agent