fix: ignore Hermes transient cleanup in deletion correlation

[cresslank]

Summary

• Ignore shell redirection tokens such as 2>/dev/null when deriving delete operands.
• Classify Hermes hermes-snap-*.sh.tmp.* environment snapshots under OS temp roots as generated artifacts.
• Classify files inside hermes_sandbox_* execute-code directories under OS temp roots as generated artifacts.
• Keep similarly named authored files outside temp roots in mass-deletion correlation.

Problem

Hermes removes these generated artifacts during normal terminal and execute-code operations. Parallel agent work could otherwise accumulate enough non-build deletions to trigger mass-file-deletion correlation and block unrelated operations.

The exemption is deliberately constrained to /tmp, /private/tmp, /var/tmp, macOS /var/folders, and Windows drive Temp roots. It does not exempt similarly named project files or directories.

Validation

• cargo fmt --check
• cargo test -p tirith-core --lib (2931 passed, 1 ignored)
• cargo clippy -p tirith-core --all-targets -- -D warnings
• release build installed locally
• four concurrent Hermes execute-code sandboxes completed without triggering deletion escalation
• regression tests cover POSIX, macOS, Windows, empty suffixes, and authored paths outside temp roots

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 23fcb1fd-3f01-455b-a205-5b8f68553284

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Hermes exemption hides authored deletions

When authored files anywhere in the filesystem have basenames beginning hermes-snap- and containing .sh.tmp., this basename-only check classifies them as build artifacts, excluding them from the non-build deletion count and allowing a destructive burst to remain below the mass-file-deletion threshold. How this was verified: The predicate feeds the non-build count summed by the critical correlation without checking the file's directory or provenance.

[cresslank]

Updated the branch to cover Hermes execute-code sandboxes and addressed the review concern by constraining all Hermes artifact exemptions to OS temp roots. Full tirith-core tests and clippy pass.

[cresslank]

Follow-up: parallel Hermes workers also delete the final hermes-snap-*.sh snapshot when they exit. d8780db classifies that final form, still only under recognized OS temp roots; authored lookalikes remain covered by negative tests. The full tirith-core suite remains green (2,931 passed, 1 ignored), with clippy clean.