fix(sessions): escape LIKE wildcards in the cwd-prefix clause

[Drexuxux]

What

_cwd_prefix_clause builds the "cwd is this directory or somewhere under it" predicate used by session listing, workspace resume, and prune/archive. Both LIKE arms bound the raw prefix:

return "(s.cwd = ? OR s.cwd LIKE ? OR s.cwd LIKE ?)", [prefix, f"{prefix}/%", f"{prefix}\\%"]

_ and % are LIKE wildcards, and both are ordinary characters in a path. _ matches any single character, so a same-length sibling directory with children falls inside the pattern. Real SessionDB, real SQLite:

cwd_prefix="/home/me/my_project"
  main -> ['sibling', 'target']     # sibling is /home/me/myXproject/src
  fix  -> ['target']

prune_sessions() deletes the rows this clause matches, along with their on-disk transcripts, so pruning one project's sessions takes an unrelated project's history with it. list_prune_candidates (which backs --dry-run and the confirmation preview) runs through the same builder, so the preview shows the same over-broad set rather than warning about it.

The bare-% case is the same class from the other direction — a prefix of /home/me/% matches every session under that root.

The fix

Escape the needle and pair both LIKE arms with ESCAPE '\' — the convention the rest of hermes_state.py already follows for user-derived text. The literal separator backslash in the Windows pattern is escaped for the same reason. The = arm is an exact compare and keeps the raw prefix.

Directory-and-children matching is unchanged for prefixes without wildcards: the clause still matches the directory itself and everything below it.

This is the follow-up I flagged in #78681, which escaped the title_like / model_like / branch_like filters and deliberately left this helper alone because it is shared by four call sites beyond prune. The two changes touch hermes_state.py in unrelated regions and do not conflict.

Tests

Added to TestPruneSessionFilters in tests/test_hermes_state.py:

• a prefix containing _ selects only the real directory, and prune_sessions deletes exactly one session — the same-length sibling survives
• a bare % prefix selects nothing
• the prefix still matches the directory itself and its children, and not a neighbour — the guard against over-escaping

Results:

181 passed

That is the whole file; the 178 pre-existing tests are unchanged and there are no pre-existing failures in it.

Red without the source change:

FAILED TestPruneSessionFilters::test_cwd_prefix_underscore_is_literal_not_a_wildcard
E   AssertionError: assert {'sibling', 'target'} == {'target'}
1 failed, 2 passed

The two control cases pass on both sides, which is what they are for.

[kshitijk4poor]

Merged via #79722 — your commit cherry-picked onto current main with authorship preserved (rebase merge), together with #78681. Follow-up we added: the inline escape in _cwd_prefix_clause now calls the _escape_like helper from the first fix, plus a regression test for the Windows backslash child arm. Thanks for flagging and finishing the whole bug class!