[rudycelekli]

What was wrong

The crontab <file> clause in crontab-modification matches only when the file is the last thing on the line (\s+[a-zA-Z0-9_./]+\s*$), and its character class has no ~. Two common installs were missed:

• Load followed by cleanup: crontab /tmp/payload.cron && rm /tmp/payload.cron.
• A file under the home directory: crontab ~/jobs.cron.

Both replace the user's crontab, which is the persistence the rule exists to catch.

The fix

The file operand may contain ~ and may be followed by end of line or a command separator: \s+[a-zA-Z0-9_./~]+\s*($|[;&|]). A listing like crontab -l && echo done still does not match, because -l is not a file operand. The rule version is now 2.

Tests

I added two match fixtures and one no_match fixture. Before the fix:

crontab-modification/crontab_load_then_cleanup: expected match, got no_match
crontab-modification/crontab_load_from_home: expected match, got no_match

What I ran

cd pkg/asymptoteobserve && go test -count=1 ./...   # all ok (go1.27.2)