Summary

Fixes #28818 — data-loss bug. hermes_cli/kanban_db.py::_cleanup_workspace ran shutil.rmtree(workspace_path) for any task whose workspace_kind == \"scratch\" (the DB default), but workspace_path is whatever the board/task config says — including a user-supplied real source directory (boards set-default-workdir) or a symlink inside the scratch root that points at ~/src. Either turned task completion into rm -rf on real data.

Fix

_cleanup_workspace (minimal change):

1. Resolve both the workspace path and workspaces_root() with resolve(strict=False) (collapses symlinks).
2. Require resolved.is_relative_to(scratch_root) and resolved != scratch_root; otherwise log a warning and return without deleting.
3. Refuse outright if wp.is_symlink() so a symlinked scratch entry can never escape via shutil.rmtree symlink-follow.
4. Python <3.9 fallback uses relative_to(...) + ValueError.

The orthogonal hardening (reject scratch-task create-time when workdir is outside workspaces_root) is left for a follow-up — out of scope for a minimal data-loss fix.

Test plan

• New TestScratchCleanupSafety in tests/hermes_cli/test_kanban_db.py — 4 cases:
  • workspace pointing at a sibling real_source/ dir outside scratch root is preserved
  • symlink inside scratch root pointing at real_source/ does not get followed
  • legitimate scratch subdir is still cleaned up
  • row pointing at the scratch root itself is refused
• Full file 162/162 pass

🤖 Generated with Claude Code