fix(core): skip tmp dirs in recursive scans

Author: skulidropek

.githooks/pre-commit

@@ -9,10 +9,9 @@ node scripts/split-knowledge-large-files.js
 while IFS= read -r -d '' knowledge_dir; do
   git add -A -- "$knowledge_dir"
 done < <(
-  find . -type d \
-    \( -name ".knowledge" -o -name ".knowlenge" \) \
-    -not -path "*/.git/*" \
-    -print0
+  find . \
+    \( -name ".git" -o -name "tmp" \) -type d -prune -o \
+    \( -type d \( -name ".knowledge" -o -name ".knowlenge" \) -print0 \)
 )
 
 # CHANGE: auto-stage AI agent config directories (.gemini, .claude, .codex)

packages/app/tests/hooks/pre-commit-ai-dirs.test.ts

@@ -97,6 +97,9 @@ const AI_DIR_STAGING_SNIPPET = `for ai_dir in .gemini .claude .codex; do
     git add -A -- "$ai_dir"
   fi
 done`
+const KNOWLEDGE_TMP_PRUNE_SNIPPET = `find . \\
+    \\( -name ".git" -o -name "tmp" \\) -type d -prune -o \\
+    \\( -type d \\( -name ".knowledge" -o -name ".knowlenge" \\) -print0 \\)`
 
 // Tests that require an isolated temp git repo
 describe("pre-commit hook (isolated repo)", () => {
@@ -182,6 +185,7 @@ describe("pre-commit hook (isolated repo)", () => {
       expect(hookContent).toContain(".claude")
       expect(hookContent).toContain(".codex")
       expect(hookContent).toContain(AI_DIR_STAGING_SNIPPET)
+      expect(hookContent).toContain(KNOWLEDGE_TMP_PRUNE_SNIPPET)
     })
 
     // INVARIANT: core.hooksPath = ".githooks" after setup
@@ -227,6 +231,7 @@ describe("committed hook files", () => {
     const content = fs.readFileSync(path.resolve(repoRoot, ".githooks/pre-commit"), "utf8")
 
     expect(content).toContain(AI_DIR_STAGING_SNIPPET)
+    expect(content).toContain(KNOWLEDGE_TMP_PRUNE_SNIPPET)
     expect(content.startsWith("#!/usr/bin/env bash\n")).toBe(true)
     expect(content).toContain("set -euo pipefail")
   })

packages/lib/src/usecases/auth-copy.ts

@@ -3,6 +3,8 @@ import type * as FileSystem from "@effect/platform/FileSystem"
 import type * as Path from "@effect/platform/Path"
 import { Effect } from "effect"
 
+const shouldSkipCopiedDir = (entry: string): boolean => entry === "tmp"
+
 const copyDirRecursive = (
   fs: FileSystem.FileSystem,
   path: Path.Path,
@@ -19,6 +21,9 @@ const copyDirRecursive = (
     for (const entry of entries) {
       const sourceEntry = path.join(sourcePath, entry)
       const targetEntry = path.join(targetPath, entry)
+      if (shouldSkipCopiedDir(entry)) {
+        continue
+      }
       const entryInfo = yield* _(fs.stat(sourceEntry))
       if (entryInfo.type === "Directory") {
         yield* _(copyDirRecursive(fs, path, sourceEntry, targetEntry))

packages/lib/src/usecases/scrap-session-import.ts

@@ -159,7 +159,8 @@ const prepareRepoForImport = (
     `git -c safe.directory="$SAFE" reset --hard ${shellEscape(ctx.manifest.repo.head)}`,
     "git -c safe.directory=\"$SAFE\" clean -fd",
     // Remove common heavy caches that are easy to rebuild with internet access.
-    "find . -name node_modules -type d -prune -exec rm -rf '{}' + 2>/dev/null || true"
+    String
+      .raw`find . \( -name tmp -o -name .git \) -type d -prune -o -name node_modules -type d -prune -exec rm -rf '{}' + 2>/dev/null || true`
   ].join("\n")
 
   return runDockerExec(

packages/lib/tests/usecases/auth-sync.test.ts

@@ -161,10 +161,13 @@ describe("syncGithubAuthKeys", () => {
         const path = yield* _(Path.Path)
         const legacyClaudeDefault = path.join(root, ".orch", "auth", "claude", "default")
         const legacyTokenPath = path.join(legacyClaudeDefault, ".oauth-token")
+        const ignoredTmpTokenPath = path.join(root, ".orch", "auth", "claude", "tmp", ".oauth-token")
         const expectedToken = "legacy-claude-token\n"
 
         yield* _(fs.makeDirectory(legacyClaudeDefault, { recursive: true }))
         yield* _(fs.writeFileString(legacyTokenPath, expectedToken))
+        yield* _(fs.makeDirectory(path.dirname(ignoredTmpTokenPath), { recursive: true }))
+        yield* _(fs.writeFileString(ignoredTmpTokenPath, "ignored-claude-token\n"))
 
         yield* _(
           migrateLegacyOrchLayout(root, {
@@ -186,7 +189,18 @@ describe("syncGithubAuthKeys", () => {
           ".oauth-token"
         )
         const migratedToken = yield* _(fs.readFileString(migratedTokenPath))
+        const migratedTmpTokenPath = path.join(
+          root,
+          ".docker-git",
+          ".orch",
+          "auth",
+          "claude",
+          "tmp",
+          ".oauth-token"
+        )
+        const hasMigratedTmpToken = yield* _(fs.exists(migratedTmpTokenPath))
         expect(migratedToken).toBe(expectedToken)
+        expect(hasMigratedTmpToken).toBe(false)
       })
     ).pipe(Effect.provide(NodeContext.layer)))
 

scripts/repair-knowledge-history.js

@@ -54,7 +54,7 @@ if (!Number.isFinite(count) || count <= 0) {
 // Run splitter + secret redaction after each commit is replayed, then amend if needed.
 const execCmd = [
   `node scripts/split-knowledge-large-files.js`,
-  `while IFS= read -r -d '' knowledge_dir; do git add -A -- "$knowledge_dir"; done < <(find . -type d \\( -name ".knowledge" -o -name ".knowlenge" \\) -not -path "*/.git/*" -print0)`,
+  `while IFS= read -r -d '' knowledge_dir; do git add -A -- "$knowledge_dir"; done < <(find . \\( -name ".git" -o -name "tmp" \\) -type d -prune -o \\( -type d \\( -name ".knowledge" -o -name ".knowlenge" \\) -print0 \\))`,
   `bash scripts/pre-commit-secret-guard.sh`,
   `if ! git diff --cached --quiet; then git commit --amend --no-edit --no-verify; fi`,
 ].join(" && ");

scripts/session-backup-gist.js

@@ -41,6 +41,7 @@ const {
 } = require("./session-backup-repo.js");
 
 const SESSION_DIR_NAMES = [".codex", ".claude", ".qwen", ".gemini"];
+const SESSION_WALK_IGNORE_DIR_NAMES = new Set([".git", "node_modules", "tmp"]);
 
 const isPathWithinParent = (targetPath, parentPath) => {
   const relative = path.relative(parentPath, targetPath);
@@ -366,7 +367,7 @@ const collectSessionFiles = (dirPath, baseName, verbose) => {
       const relPath = relativePath ? `${relativePath}/${entry.name}` : entry.name;
 
       if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") {
+        if (SESSION_WALK_IGNORE_DIR_NAMES.has(entry.name)) {
           continue;
         }
         walk(fullPath, relPath);

scripts/session-backup-repo.js

@@ -15,6 +15,7 @@ const GH_GIT_CREDENTIAL_HELPER = "!gh auth git-credential";
 const CHUNK_MANIFEST_SUFFIX = ".chunks.json";
 const DOCKER_GIT_CONFIG_FILE = "docker-git.json";
 const GITHUB_ENV_KEYS = ["GITHUB_TOKEN", "GH_TOKEN"];
+const PROJECT_WALK_IGNORE_DIR_NAMES = new Set([".git", "node_modules", ".cache", "tmp"]);
 
 const parseEnvText = (text) => {
   const entries = [];
@@ -90,7 +91,7 @@ const findDockerGitProjectForTarget = (projectsRoot, targetDir, log) => {
       if (!entry.isDirectory()) {
         continue;
       }
-      if (entry.name === ".git" || entry.name === "node_modules" || entry.name === ".cache") {
+      if (PROJECT_WALK_IGNORE_DIR_NAMES.has(entry.name)) {
         continue;
       }
       stack.push(path.join(currentDir, entry.name));

scripts/setup-pre-commit-hook.js

@@ -29,10 +29,9 @@ node scripts/split-knowledge-large-files.js
 while IFS= read -r -d '' knowledge_dir; do
   git add -A -- "$knowledge_dir"
 done < <(
-  find . -type d \\
-    \\( -name ".knowledge" -o -name ".knowlenge" \\) \\
-    -not -path "*/.git/*" \\
-    -print0
+  find . \\
+    \\( -name ".git" -o -name "tmp" \\) -type d -prune -o \\
+    \\( -type d \\( -name ".knowledge" -o -name ".knowlenge" \\) -print0 \\)
 )
 
 # CHANGE: auto-stage AI agent config directories (.gemini, .claude, .codex)

scripts/split-knowledge-large-files.js

@@ -5,7 +5,7 @@ const path = require("node:path");
 
 const MAX_BYTES = 99 * 1000 * 1000;
 const KNOWLEDGE_DIR_NAMES = new Set([".knowledge", ".knowlenge"]);
-const WALK_IGNORE_DIR_NAMES = new Set([".git", "node_modules"]);
+const WALK_IGNORE_DIR_NAMES = new Set([".git", "node_modules", "tmp"]);
 const MANIFEST_SUFFIX = ".chunks.json";
 const CHUNK_BYTES = 1024 * 1024;
 
@@ -85,6 +85,7 @@ const walk = (dir) => {
   for (const entry of entries) {
     const fullPath = path.join(dir, entry.name);
     if (entry.isDirectory()) {
+      if (WALK_IGNORE_DIR_NAMES.has(entry.name)) continue;
       walk(fullPath);
       continue;
     }