fix(s03): match Windows del as a command word

s05_todo_write/README.ja.md

@@ -122,6 +122,10 @@ Agent がタスクを受け取った後の典型的な流れ：まず `todo_writ
 
 ---
 
+## 継承する権限ルール
+
+この章は s04 の permission hook を引き継ぐ。command の先頭または shell separator（`;`、`&&`、`||`、`|`、`&`、括弧、改行）の直後にある完全な `rm`/`del` command word だけを大文字小文字を区別せず検出する。`model`、`delimiter`、`echo del test.txt` は危険な command として扱わない。
+
 ## 試してみよう
 
 ```sh

s05_todo_write/README.md

@@ -122,6 +122,10 @@ Typical flow when the Agent receives a task: first call `todo_write` to list all
 
 ---
 
+## Inherited permission rule
+
+This chapter carries forward the permission hook from s04. It recognizes `rm` and `del` case-insensitively only as complete command words at the start of a command or after a shell separator (`;`, `&&`, `||`, `|`, `&`, parentheses, or a newline). It does not treat `model`, `delimiter`, or `echo del test.txt` as destructive.
+
 ## Try It
 
 ```sh

s05_todo_write/README.zh.md

@@ -122,6 +122,10 @@ Agent 收到任务后的典型流程：先调 `todo_write` 列出所有步骤（
 
 ---
 
+## 继承的权限规则
+
+本章沿用 s04 的权限 hook：只在命令开头或 shell 分隔符（`;`、`&&`、`||`、`|`、`&`、括号或换行）之后，按大小写不敏感方式识别完整的 `rm`/`del` 命令词。`model`、`delimiter` 和 `echo del test.txt` 不会被当成危险命令。
+
 ## 试一下
 
 ```sh

s05_todo_write/code.py

@@ -25,6 +25,7 @@ without an update, the harness adds a reminder alongside the tool results.
 import ast
 import json
 import os
+import re
 import subprocess
 from pathlib import Path
 
@@ -218,7 +219,15 @@ def trigger_hooks(event: str, *args):
     return None
 
 DENY_LIST = ["rm -rf /", "sudo", "shutdown", "reboot", "mkfs", "dd if="]
-DESTRUCTIVE = ["rm ", "> /etc/", "chmod 777"]
+DESTRUCTIVE_COMMAND_WORD = re.compile(
+    r"(?i)(?:^|[;&|()\n])\s*(?:rm|del)(?=\s|$|[;&|()])"
+)
+DESTRUCTIVE = ["> /etc/", "chmod 777"]
+
+
+def contains_destructive_command(command: str) -> bool:
+    return bool(DESTRUCTIVE_COMMAND_WORD.search(command))
+
 
 def permission_hook(block):
     """PreToolUse: s03 permission logic, registered as an s04 hook."""
@@ -228,13 +237,14 @@ def permission_hook(block):
             if pattern in command:
                 print(f"\n\033[31m[blocked] '{pattern}'\033[0m")
                 return "Permission denied by deny list"
-        for keyword in DESTRUCTIVE:
-            if keyword in command:
-                print(f"\n\033[33m[permission] Potentially destructive command\033[0m")
-                print(f"   Tool: {block.name}({block.input})")
-                choice = input("   Allow? [y/N] ").strip().lower()
-                if choice not in ("y", "yes"):
-                    return "Permission denied by user"
+        if contains_destructive_command(command) or any(
+            keyword in command for keyword in DESTRUCTIVE
+        ):
+            print(f"\n\033[33m[permission] Potentially destructive command\033[0m")
+            print(f"   Tool: {block.name}({block.input})")
+            choice = input("   Allow? [y/N] ").strip().lower()
+            if choice not in ("y", "yes"):
+                return "Permission denied by user"
     if block.name in ("read_file", "write_file", "edit_file"):
         path = block.input.get("path", "")
         if not (WORKDIR / path).resolve().is_relative_to(WORKDIR):